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ОЕР 


РКЕЕАСЕ 


The Shuttle Crew Operations Manual (SCOM) 
is a unique document containing information 
about each shuttle system and every phase of a 
generic space shuttle mission. 


The SCOM is a reference document for space 
shuttle crewmembers. The complexity of the 
shuttle systems and the unique operational 
environment, coupled with the numerous 
malfunction/emergency procedures, necessi- 
tated some departures from an aircraft manual 
approach (e.g. Air Force Dash1 or Navy/ Marine 
Corps NATOPS). Nonetheless, the SCOM is the 
only single source document, written 
specifically for shuttle astronauts, with 
comprehensive data about shuttle systems and 
operations. 


This document contains condensed information 
from а large number of space shuttle 
publications, including the Flight Data File 
(FDF) Crew Training workbooks, Flight 
Procedure Handbooks (FPH), Flight Rules, 
Shuttle Operational Data Book, and Shuttle 
Performance Assessment Data Book. The 
SCOM is not a replacement for any of these 
documents. It has been carefully reviewed by 
Flight Crew Operations Directorate (FCOD) and 
Mission Operations Directorate (MOD) 
personnel to ensure accuracy of information. In 
all cases, should a conflict arise between the 
SCOM and FDF or Flight Rules, the FDF and 
Flight Rules will govern. If conflicts arise 
between the SCOM and workbooks/FPHs, the 
conflicts should be resolved with the appro- 
priate book manager or system representative. 


Information contained in the SCOM is current 
per the Flight Software Operational Increment 
(OI) designated on the cover page. If this 5СОМ 
is published BEFORE the first launch of the 
designated OI then the SCOM 18 current to 
expected requirements. If this SCOM is 
published AFTER the first flight of a designated 
OL the SCOM will be current per "as-flown" 
operational feedback from crews and ground 
operators. CRT displays documented in the text 
and in Appendix B are the CRT displays 
documented in the Level C Functional 
Subsystem Software Requirements Display and 
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Controls Specification, STS 83-0020V, for the 
designated OI. It should be noted that several 
CRT displays provided in the body of this 
document are for illustrative purposes only; 
certain CRT displays contain data combined in 
one illustration that do not appear 
simultaneously in operational use. 


Additional information or clarification 15 
presented in three formats: notes, cautions, and 
warnings. Notes provide amplifying informa- 
tion of a general nature. Cautions provide 
information and instructions necessary to 
prevent hardware damage or malfunction. 
Warnings provide information and instructions 
necessary to ensure crew safety. The formats in 
which this material appears are illustrated 
below. 


NOTE 


A Ђагђегроје APU/HYD READY TO 
START talkback will not inhibit a start. 


CAUTION 


After an APU auto shutdown, the APU 
FUEL TK VLV switch must be taken to 
CLOSE prior to inhibiting auto shutdown 


logic. Failure to do so can allow the fuel 
tank isolation valves to reopen and flow 
fuel to an APU gas generator bed that is 
above the temperature limits for safe 
restart. 


WARNING 


The FUEL CELL REAC switches on panel 
R1 are in a vertical column with FUEL 
CELL 1 REAC on top, FUEL CELL 3 REAC 
in the middle, and FUEL CELL 2 REAC on 


the bottom. This was done to allow the 


schematic to be placed on the panel. 
Because the switches are not in numerical 
order, it is possible to inadvertently close 
the wrong fuel cell reactant valve when 
shutting down a fuel cell. 
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Configuration Control Plan 


The SCOM will be updated рег the 
specifications in the latest Space Flight 
Operations Contract (БЕОС) agreement between 
the Space Shuttle Program and the United Space 
Alliance (USA). USA's ongoing MOD and 
FCOD support in the Shuttle Avionics Software 
Control Board (SASCB), Program Requirements 
Control Board (PRCB), Flight Rules Control 
Board (FRCB), and Crew Procedures Control 
Board (CPCB) processes will keep the Shuttle 
Ops community apprised of vehicle impacts to 
flight operations and associated documentation. 
The SCOM update effort (including 
configuration control) will be performed by the 
SCOM Development Team and led by the 
SCOM Book Manager. Astronaut Office 
participation in the SCOM update effort will be 
coordinated per the SCOM Development Task 
specified in the Training Operations Handbook. 
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ii 


Program Documentation 


There are a multitude of documents delineating 
the organization and operation of the space 
shuttle program (SSP). The following charts 
depict the SSP organization, major program 
documents (NSTS 07700) and associated 
processes. Each major process will have a 
significant collection of associated publications. 
Several hundred of these documents have been 
utilized in the development of the SCOM. 
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The section provides general background 
information about the orbiter, its configuration 
and coordinate systems, the nominal mission 
profile, and general procedures followed 
during a shuttle mission. It also briefly 
discusses components, such as the external tank 
and solid rocket, that are not included in the 
next section on orbiter systems. 
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11 OVERVIEW Space Shuttle Requirements 


The space shuttle system consists of four 
primary elements: an orbiter spacecraft, two 
solid rocket boosters (SRBs), an external tank 
(ET) to house fuel and oxidizer, and three space 
shuttle main engines (SSMEs). The shuttle can 
transport payloads into near Earth orbit 100 to 
312 nm above the Earth. Payloads are carried in 
a bay 15 feet in diameter and 60 feet long. 
Major system requirements are that the orbiter 
and the two SRBs be reusable. 


CONTENTS 


Space Shuttle Requirements ................ 1.1-1 
Nominal Mission Profile ...................... 11-2 
Launch and Landing Sites ................... 1.1-5 


Orbiter Ground Turnaround ............... 1.1-6 
Space Shuttle Coordinate 

Reference System........................ 11-7 
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The orbiter has carried а flight crew of up to 
eight persons. The nominal mission is 4 to 16 
days in space. The crew compartment has a 
shirtsleeve environment, and the acceleration 
load is never greater than 3 g's. In its return to 
Barth, the orbiter has a crossrange maneuvering 
capability of about 1,100 nm 


Solid rocket booster 
17.17 feet diameter 


External tank 
27.5 feet 
diameter 


SRB thrust 
attachment 


I ——— 122.17 feet ——> 56.67 їве! ole 


Orbiter Tank orbiter 
gemm 


attachments 


154.2 feet 
184.2 feat 


012.сув 


Space Shuttle Statistics 
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Nominal Mission Profile 


Launch 


In the launch configuration, the orbiter and two 
SRBs are attached to the ET in a vertical (nose- 
up) position on the launch pad. Each SRB is 
attached at its aft skirt to the mobile launcher 
platform by four bolts. 


The three SSMEs, fed liquid hydrogen fuel and 
liquid oxygen oxidizer from the ET, are ignited 
first. When it has been verified that the engines 
are operating at the proper thrust level, a signal 
is sent to ignite the SRBs. At the proper thrust- 
to-weight ratio, initiators (small explosives) at 
eight hold-down bolts on the SRBs are fired to 
release the space shuttle for lift-off. Elapsed 
time is a few seconds. 


Maximum dynamic pressure is reached early in 
the ascent, nominally 30 to 60 seconds after lift- 
off. Approximately 1 minute later (2 minutes 
into the ascent phase), the two SRBs have 
consumed their propellant and are jettisoned 
from the ET. This is triggered by a separation 
signal from the orbiter. 


The boosters briefly continue to ascend, while 
small thrusters fire to carry them away from the 
space shuttle. The boosters then turn and 
descend, and at a predetermined altitude, 
parachutes are deployed to decelerate them for 
a safe splashdown in the ocean. Splashdown 
occurs approximately 141 nm from the launch 
site. The boosters are recovered and reused. 


The orbiter and ET continue to ascend, using 
the thrust of the three SSMEs. Approximately 
8 minutes after launch, the three engines 
undergo main engine cutoff (or MECO), and the 
ET is jettisoned on command from the orbiter. 


The forward and aft reaction control system 
(RCS) jets provide attitude control, translate the 


1. GENERAL DESCRIPTION 


1.1 Overview 


orbiter away from the ET at separation, and 
maneuver the orbiter to burn attitude prior to 
the orbital maneuvering system (OMS) burn. 
The ET continues on a ballistic trajectory and 
enters the atmosphere, where it disintegrates. 
Its nominal impact is in the Indian Ocean for a 
28° inclination launch. 


Orbit Insertion and Circularization 


The normal ascent profile, referred to as “direct 
insertion,” places the vehicle in a temporary 
elliptical orbit at MECO. Orbital altitudes can 
vary from 100 to 312 nm, depending on mission 
requirements. The crew then performs an OMS 
burn, designated as “OMS 2”, to stabilize the 
orbit. This burn can add anywhere between 200 
to 550 fps to the vehicle’s orbital velocity, as 
necessary. 


In cases of severe performance problems during 
the ascent, the vehicle may find itself well short 
of the expected MECO velocity, and even sub- 
orbital. In such cases, the crew performs what 
is called an “OMS 1” burn, which raises the 
orbit to a safe altitude. They then peform an 
OMS 2 burn to stablize that orbit. 


Orbit 


On orbit, the forward and aft RCS jets provide 
attitude control of the orbiter, as well as any 
minor translation maneuvers along a given axis. 
The OMS engines are used to perform orbital 
transfers, such as those done to rendezvous 
with the International Space Station (ISS). 
While on orbit, the crew fulfills mission 
objectives, such as ISS assembly and logistics, 
payload deployment or retrieval, and scientific 
experiments. 


MAIN ENGINE 
CUTOFF, EXTERNAL 
TANKS SEPARATION 


Altitude: 

59 nautical miles 
Velocity: 25,581 feet 
per second about 8.5 
minutes after launch 
(just before orbit 
insertion) 


ORBITER INSERTION 
AND CIRCULARIZATION 

For either one or two OMS burns to 
change trajectory from suborbital 
to orbital; typically 200 to 550 feet 
per second velocity increase. 
Altitude 100 to 312 nautical miles 


SRB SEPARATION 
Two minutes after 
launch 


LAUNCH 


Maximum dynamic 
pressure about 

60 seconds 

after launch 


_ TURNAROUND 
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ORBITAL 
OPERATIONS 


Mission: 

Nominal 4 to 16 
days; 100 t0 316 
nautical mile orbits; 
25,000 feet per 
second 


DEORBIT 

Velocity decreased nominal 
(200 to 550 feet per second) 
from Earth orbit operations 


LANDING 


Touchdown speed 
195 or 250 knots 


Shuttle Mission Profile 


Deorbit 


At the completion of orbital operations, the RCS 
is used to orient the orbiter in а tail-first 
attitude. The two OMS engines are burned to 
lower the orbit such that the vehicle enters the 
atmosphere at a specific altitude and range from 
the landing site. The deorbit burn usually 
decreases the vehicle's orbital velocity 
anywhere from 200 to 550 fps, depending on 
orbital altitude. When the deorbit burn is 
complete, the RCS is used to rotate the orbiter's 
nose forward for entry. The КС5 jets are used 
for attitude control until atmospheric density is 


sufficient for the pitch, roll and yaw 
aerodynamic control surfaces to become 
effective. 


11-3 


Entry 


Entry interface, the point where the vehicle 
enters the atmosphere, is considered to occur at 
an altitude of 400,000 feet, approximately 
4,200 nm from the landing site, and at a velocity 
of approximately 25,000 fps. The orbiter is 
maneuvered to 0° roll and yaw (wings level) 
and a 40° angle of attack for entry. The flight 
control system issues the commands to roll, 
pitch, and yaw RCS jets for rate damping. 
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The forward RCS jets are not used during entry, 
as they would adversely affect the vehicle’s 
aerodynamics otherwise. Thus, only the aft 
RCS jets are initally used to maneuver the 
vehicle. At a dynamic pressure (qbar) of 10 psf, 
the orbiter’s aerosurfaces become effective for 
roll control, and the roll function in the aft RCS 
jets is deactivated. At a qbar of 40 psf, the 
aerosurfaces become more effective, and the 
RCS pitch function is deactivated. The orbiter’s 
speed brake is used below Mach 10 to help keep 
the elevons in the airstream. At Mach 5, the 
rudder becomes active and is used for trim. 
Finally, at Mach 1, all RCS jet activity is 
deactived, leaving only the aerosurfaces to 
maneuver the vehicle. 


Entry guidance must dissipate the tremendous 
amount of energy the orbiter possesses when it 
enters the Earth’s atmosphere to assure that the 
orbiter does not either burn up (entry angle too 
steep) or skip out of the atmosphere (entry 
angle too shallow). It must also properly 
position the vehicle to reach the desired 
touchdown point. Guidance does all this by 
controlling the atmospheric drag оп the 
orbiter’s surface. Higher atmospheric drag 
levels enable faster energy dissipation with a 
steeper trajectory. 


Controlling atmospheric drag is achieved by 
varying either the angle of attack or the bank 
angle. However, varying the angle of attack 
early during entry creates surface temperatures 
above the orbiter’s design specification. This 
leaves varying bank angle for energy control. 
Increasing the bank angle decreases the vertical 
component of lift, causing a higher sink rate, 
greater atmospheric drag and thus more energy 
dissipation. This, too, raises the surface 
temperature of the orbiter, but not nearly as 
drastically as would increasing the angle of 
attack. 


If the orbiter is low on energy (1.6. the range to 
the landing site is much greater than expected, 
given the current velocity), entry guidance will 
command lower than nominal drag levels. If 
the orbiter has too much energy (i.e. the range 
to the landing site is much less than expected, 
given the current velocity), entry guidance will 
command higher-than-nominal drag levels to 
dissipate the extra energy. 
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Bank angle is also used to control crossrange. 
Azimuth error is the angle between the plane 
containing the orbiter's position vector and the 
heading alignment cone tangency point and the 
plane containing the orbiter's position vector 
and velocity vector. When the azimuth error 
exceeds a computer-loaded number, the 
orbiter's bank angle is reversed. 


Thus, descent rate and downranging are 
controlled by bank angle. The steeper the bank 
angle, the greater the descent rate and the 
greater the drag. Conversely, the minimum 
drag attitude is wings level.  Crossrange is 
controlled by bank reversals. The entry thermal 
control phase is designed to keep the backface 
and surface temperatures within the design 
limits. А constant heating rate is established 
until a velocity below 19,000 fps. 


The equilibrium glide phase transitions the 
orbiter from the rapidly increasing drag levels 
of the temperature control phase to the constant 
drag level of the constant drag phase. The 
equilibrium glide flight is defined as flight in 
which the flight path angle, which is the angle 
between the local horizontal and the local 
velocity vector, remains constant. Equilibrium 
glide flight provides the maximum downrange 
capability. It lasts until the drag acceleration 
reaches 33 fps?. 


The constant drag phase begins at that point. 
The angle of attack is initially 40°, but it begins 
to ramp down to approximately 36? by the end 
of this phase. 


In the transition phase, the angle of attack 
continues to ramp | down, reaching 
approximately 14? at the entry terminal area 
energy management (ТАЕМ) interface, at an 
altitude of approximately 83,000 feet, a velocity 
of 2,500 fps, and a range of 60 nm from the 
runway. Control is then transferred to ТАЕМ 
guidance. 


During the entry phases described, the orbiter's 
bank commands keep the orbiter on the drag 
profile and control crossrange. 


ТАЕМ 


TAEM (terminal area energy management) 
steers the orbiter to one of two 18,000-ft radius 
heading alignment cones (HAC), which are 
located tangent to and on either side of the 
runway centerline on the approach end. In 
TAEM guidance, excess energy is dissipated 
with an S-turn. This increases the ground track 
range as the orbiter turns away from the HAC 
until sufficient energy is dissipated to allow a 
normal approach and landing guidance phase 
capture, which begins at 10,000 feet altitude. 
The orbiter also can be flown near the velocity 
for maximum lift over drag or wings level for 
the range stretch case. The spacecraft slows to 
subsonic velocity at approximately 49,000 feet 
altitude, about 26 nm from the landing site. 


At TAEM acquisition, the orbiter is turned until 
it is aimed at a point tangent to the HAC and 
continues until it reaches way point (WP) 1. At 
WP-1, the TAEM heading alignment phase 
begins. The HAC is followed until landing 
runway alignment, +20°, has been achieved. In 
the TAEM prefinal phase, the orbiter pitches 
down to acquire the steep glideslope, increases 
airspeed, banks to acquire the runway 
centerline, and continues until on the runway 
centerline, on the outer glideslope, and on 
airspeed. The approach and landing guidance 
phase begins with the completion of the TAEM 
prefinal phase and ends when the spacecraft 
comes to a complete stop on the runway. 


Landing 


The approach and landing trajectory capture 
phase begins at the approach and landing 
interface and continues to acquisition of the 
steep outer glideslope. The approach and 
landing phase begins at about 10,000 feet 
altitude at an equivalent airspeed of 300 knots 
equivalent airspeed (KEAS) and 5.8 or 63 nm 
(for -20? or -18? glideslope, respectively) from 
touchdown. Approach and landing guidance is 
initiated at this point to guide the orbiter to the 
-20? or -18? glideslope aimed at a target 7,500 
feet short of the runway. The speed brake is 
modulated to hold the reference velocity. The 
descent rate in the later portion of TAEM and 
approach and landing is greater than 10,000 feet 
per minute. 
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At 2,000 feet above ground level (AGL), a 
preflare maneuver is started to position the 
spacecraft for a 1.5° inner glideslope in 
preparation for landing with the speed brake 
positioned to control touchdown energy. The 
flight crew deploys the landing gear at 300 feet 
AGL. The final flare reduces the sink rate of the 
spacecraft to a target value of 3 fps. 
Touchdown occurs approximately 2,500 feet 
past the runway threshold at a speed of 195 
KEAS (lightweight orbiters) or 205 KEAS 
(heavyweight orbiters). 


Launch and Landing Sites 


The Kennedy Space Center (KSC) in Florida is 
used for all shuttle launches. Shuttle landings 
occur at KSC, also, as well as at Edwards Air 
Force Base in California. Contingency landing 
sites are also provided in the event the orbiter 
must return to Earth in an emergency. 


A 035° azimuth launch places the spacecraft in 
an orbital inclination of 57°, which means the 
spacecraft in its orbital trajectories around Earth 
will never exceed an Earth latitude higher or 
lower than 57° north or south of the equator. A 
launch path from KSC at an azimuth of 090° 
(due east from KSC) will place the spacecraft in 
an orbital inclination of 28.5°. 


These two azimuths, 035° and 090°, represent 
the current launch limits from KSC. Any 
azimuth angles further north or south would 
launch a spacecraft over a habitable land mass, 
adversely affect safety provisions for abort or 
vehicle separation conditions, or present the 
undesirable possibility that the SRB or external 
tank could land on inhabited territory. 


The Earth rotates from west to east at a speed of 
approximately 900 nautical miles (nm) per hour. 
For due east launches (090° azimuth), the 
Earth’s rotational velocity adds to the velocity 
increase caused by the SRBs and main engines. 
Due east launches provide the maximum 
payload and altitude capability. Launches on 
azimuths other than due east benefit less and 
less from Earth’s rotation as the launch azimuth 
approaches north or south. Westerly launches 
would decrease performance even further. 
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Orbiter Ground Turnaround 


Spacecraft recovery operations at the nominal 
end-of-mission landing site are supported by 
approximately 160 space shuttle launch oper- 
ations team members. Ground team members 
wearing self-contained atmospheric protective 
ensemble suits that protect them from toxic 
chemicals approach the spacecraft as soon as it 
stops rolling. The ground team members take 


Prelaunch 
® Move to pad 
• Interface verification 


® Payload installation 
(optional at pad) 


® Propellant loading 
® Crew ingress 
® System check 


e$ 


Shuttle Assembly 


* Ordinance installation 
and connection 


А second GSE ground cooling unit is connected 
to the left-hand orbiter T-0 umbilical spacecraft 
Freon coolant loops to provide cooling for the 
flight crew and avionics during the postlanding 
and system checks. The spacecraft fuel cells 
remain powered up at this time. Тһе flight 
crew then exits the spacecraft, and a ground 
crew powers down the spacecraft. The orbiter 
and GSE convoy eventually move from the 
runway to the Orbiter Processing Facility (OPF). 


Landing В 


® Safety inspection 
® Connect and ground support equipment 1 
® Сгеу/ ехсһапде | 


э 2 
Orbiter Safing 
* Maintenance and checkout 


ө Payload installation 
(optional at Orbiter Processing Facility) 


® Functional verification 


Premate Preparation 


006.tif 


Kennedy Space Center Ground Turnaround Sequence 


sensor measurements to ensure the atmosphere 
in the vicinity of the spacecraft is not 
hazardous. In the event of propellant leaks, a 
wind machine truck carrying a large fan is 
moved into the area to create a turbulent 
airflow that will break up gas concentrations 
and reduce the potential for an explosion. 


A ground support equipment (GSE) air- 
conditioning purge unit is attached to the right- 
hand orbiter T-0 umbilical so cool air can be 
directed through the orbiter's aft fuselage, 
payload bay, forward fuselage, wings, vertical 
stabilizer, and OMS/RCS pods to dissipate the 
heat of entry. 


1. GENERAL DESCRIPTION 


1.1 Overview 


If the spacecraft lands at Edwards Air Force 
Base, the same procedures and GSE are used 
after the orbiter has stopped on the runway. 
The orbiter and GSE convoy move from the 
runway to the orbiter mate and demate facility. 
After detailed inspection, the spacecraft is 
prepared to be ferried atop the Shuttle Carrier 
Aircraft from Edwards Air Force Base to KSC. 
For ferrying, a tail cone is installed over the aft 
section of the orbiter. 


In the event of a landing at an alternate site, a 
crew of about eight will move to the landing 
site to assist the astronaut crew in preparing the 
orbiter for loading aboard the Shuttle Carrier 
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Aircraft for transport back to KSC. For landings 
outside the U.S., personnel at the contingency 
landing sites will be provided minimum 
training on safe handling of the orbiter, with 
emphasis on crash rescue training, towing the 
orbiter to a safe area, and prevention of 
propellant conflagration. 


Upon its return to the OPF at KSC, the orbiter is 
safed (ordnance devices safed), the payload (if 
any) is removed, and the orbiter payload bay is 
reconfigured for the next mission. Any 
required maintenance and inspections are also 
performed while the orbiter is in the OPF. A 
payload for the orbiter's next mission may be 
installed in the orbiter's payload bay in the OPF 
or when the orbiter is at the launch pad. 


While the orbiter is being refurbished, the ET 
and SRBs (which are also processed at KSC) are 
stacked and mated on the mobile launch 
platform in the Vehicle Assembly Building 
(VAB). Once prepared, the orbiter is towed 
from the OPF to the VAB mated to the ET/SRB 
stack. Connections are made, the integrated 
vehicle is checked, and ordnance is installed. 


The mobile launch platform moves the entire 
space shuttle system on a crawler transporter to 
the launch pad, where connections are made, 
and servicing and checkout activities begin. If 
the payload was not installed in the OPF, it is 
installed at the launch pad followed by 
prelaunch activities. 
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KSC Launch Operations has the responsibility 
for all mating, prelaunch testing, and launch 
control ground activities until the space shuttle 
clears the launch pad tower. Responsibility is 
then turned over to the Mission Control Center 
(MCC) at the Johnson Space Center in Texas. 
MCC’s responsibility includes ascent, on-orbit 
operations, entry, approach, and landing until 
crew egress, at which time the orbiter is handed 
over to the postlanding operations at the 
landing site for turnaround and relaunch. 


Space Shuttle Coordinate Reference 
System 


The space shuttle coordinate reference system is 
a means of locating specific points on the 
orbiter. The system is measured in inches and 
decimal places; Хо designates the longitudinal 
axis, Y, the lateral axis, and Zo the vertical axis. 
The subscript “о” indicates orbiter; similar 
reference systems are used for the ET (T), SRB 


(B), and overall space shuttle system (S). 


In each coordinate system, the X-axis zero point 
is located forward of the nose tip; 1.е., the 
orbiter nose tip location is 236 inches aft of the 
zero point (at Хо = 236), the ET nose cap tip 
location is at Хт = 322.5, and the SRB nose tip 
location is at Хв = 200. In the orbiter, the 
horizontal Хо, Yo reference plane is located at 
Zo = 400, which is 336.5 inches above the ET 
horizontal Xt, Yr reference plane located at Zr = 
400. The SRB horizontal Xz, Ув reference plane 


FRL е +X 
ЈУ он 
250.5 IN. ^ 250.5 IN. 


E, Ж 


SUBSCRIPTS 


T = EXTERNAL TANK 

в - SOLID ROCKET 
BOOSTER 

0 - ORBITER 

5 - SHUTTLE SYSTEM 

FRL - FUSELAGE REFERENCE 
LINE 
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Crew Cabin (Cutaway View) 


is located at Zg = 0 and coincident with the ET 
horizontal plane at Zr = 400. The solid rocket 
booster vertical Xs, Zr planes are located at + 
Ys = 250.5 and -Ys = 250.5. Also, the orbiter, 
external tank, and shuttle system center X, Z 
planes coincide. 


From the X = 0 point, aft is positive, and 
forward is negative for all coordinate systems. 
Looking forward, each shuttle element Y-axis 
point right of the center plane (starboard) is 
positive and each Y-axis point left of center 
(port) is negative. The Z axis of each point 
within all elements of the shuttle except the 
SRBs is positive, with Z = 0 located below the 
element. In the SRBs, each Z-coordinate point 
below the Xs, Ys reference plane is negative, 
and each point above that plane is positive. 


The shuttle system and shuttle element 
coordinate systems are related as follows: the 
external tank Xr = 0 point coincides with Xs = 
0, the SRB Хв 0 point is located 543 inches aft, 
and the Ү,, 4, reference plane is 741 inches aft 
of Xs = 0. 


Location Codes 


Orbiter location codes enable crewmembers 
to locate displays and controls, stowage 
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compartments and lockers, access panels, and 
wall-mounted equipment in the orbiter crew 
compartments. The crew compartments are 
the flight deck, middeck, and airlock. A 
fourth. compartment becomes part of the 
configuration when the Spacehab is flown. 
Because of compartment functions and 
geometry, each has a unique location coding 
format. 


Flight Deck Location Codes 


A flight deck location code consists of two or 
three alphanumeric characters. The first 
character is the first letter of a flight deck 
surface as addressed while sitting in the 
commander/ pilot seats. The characters are: 


L — Left 

R — Right 

Е — Forward 

A — Aft 

С — Center Console 
О — Overhead 

S — Seats 

W — Windows 
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SURFACES GENERAL NUMBERING PHILOSOPHY 


L -Left 
R - Right 
С - Center console 


О - Overhead Numbered from left to right, forward to aft 


Е - Forward е Numbered left to right, top to bottom 
А -Aft e (facing the surface 


e Numbered from the top to bottom, forward to aft 


W - Windows e The forward windows are numbered left to right 


(W1 through W6) facing forward 


• The overhead windows are numbered left to 
right (W7 and М/8) facing aft 


e The aft windows are numbered left to right 


S - Seats е The CDR's seat is S1 and the PLT's seat is S2 


General Numbering Scheme for Flight Deck 
Surfaces 
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The second and third characters are numerics 
identifying Ње relative location of 
components on each flight deck surface. The 
numbering system philosophy is summarized 
in the table at left. 


Over head 


Panels —— |! 


Windows —— 3 к a И 
Qe WS 
у <L ЕЗ | "5 
» 
\ ЕТ © 
ЕВ 
Оој~ 
| FS "m 
e E 
n B2 ~ 
с! | / қы 2% 
ы E 


ТЕГІН 


C6 | 
иргэн эсийн Center Console 
VEU 
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Middeck Location Codes 


The middeck location codes have five characters 
specifying the following: 


First character - M for middeck 


Second character - The first letter of a 
middeck surface; the characters and 
surfaces are: 


L - Left A - Aft 
R - Right D - Deck 
F - Forward O - Overhead 


SURFACES REFERENCE POSITION 
Ц, В, Е, А Standing on deck facing the surface 


Ган Standing on deck facing forward (+X) looking down 


The overhead location grid matches the grid on the deck; 
1.е., a point on the overhead has the same third, fourth, 
fifth characters as a point directly below it on the deck 


Middeck Location Codes (2 of 2) 


The reference position for identifying the 
surface is standing on the middeck floor (deck) 
facing forward (+X). 


Third/fourth/fifth characters - These 


characters form a location grid on each 
middeck surface. The third and fourth 
characters are numerics indicating the 
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distance from the left side of a surface 
expressed as a percentage of the total 
width of the surface (follows the contour of 
the wall). 


The fifth character is an alpha character 
indicating the distance from the top of a 
surface expressed alphabetically in 
increments of 6 inches. 


NOTE 


The middeck panel numbers are not 
consistent with the location coding 
system defined by this document. 
However, in each case, the location 
coding, as indicated, is in close 
proximity to the actual location. 
Panel numbers were assigned prior to 
the middeck closeout panel design 
definition. The starting points for 
location coding were behind the 
closeout panels, whereas the starting 
points used in this document are in 
front of the closeout panels. 


Airlock Location Codes 


An airlock code consists of four or five 
alphanumeric characters, which specify the 
following: 


First character - A for airlock 


Second character - The first letter of an 
airlock surface; the characters and surfaces 
are: 


W - Wall 

O - Overhead 

D - Deck 
The ^wall" is the inner wall of the cylindrical 
airlock. The "overhead" and "deck" are flat 


surfaces at each end of the cylinder. The airlock 
is oriented upside down with respect to the 
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middeck, so that the airlock overhead 
corresponds to the middeck floor. The wall 


location codes have five characters, and the 
overhead/ deck codes have four characters. 


Ihird/fourth/fifth characters (wall only) - 


These characters form a location grid on the 
airlock wall. The third and fourth characters 
are numerics indicating the distance (clockwise) 
from the vertical centerline of the forward hatch 
(ашїосК in) expressed as a percentage of the 
total airlock circumference. The fifth character 
is an alpha character indicating the distance 
from the overhead surface expressed 
alphabetically in increments of 6 inches. 


Ihird/fourth characters (overhead / deck only)- 


These characters form location grids on the deck 
and overhead surfaces. Since these surfaces are 
small, items can be easily located without the 
aid of the location grids. 


MIDDECK FORWARD 


1. 286 IN. 
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1.1 Overview 


1.2 ORBITER STRUCTURE 
CONTENTS 

Forward Fuselage 

Crew Compartment 

Forward Fuselage and Crew 


Compartment Windows 


Midfuselage 


Aft Fuselage 

Orbital Maneuvering System/ 
Reaction Control System 
(OMS/RCS) Pods 


The orbiter structure is divided into nine major 
sections: (1) forward fuselage, which consists of 
upper and lower sections that fit clamlike 
around a pressurized crew compartment, (2) 
wings, (3) midfuselage, (4) payload bay doors, 
(5) aft fuselage, (6) forward RCS, (7) vertical tail, 
(8) OMS/RCS pods, and (9) body flap. The 
majority of the sections are constructed of 
conventional aluminum and_ protected by 
reusable surface insulation. 


Forward Fuselage 


The forward fuselage consists of the upper and 
lower fuselages. It houses the crew compart- 
ment and supports the forward RCS module, 
nose cap, nose gear wheel well, nose gear, and 
nose gear doors. 
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The forward fuselage is constructed of 
conventional 2024 aluminum alloy skin-stringer 
panels, frames, and bulkheads. The panels are 
single curvature, stretch-formed skins with 
riveted stringers spaced 3 to 5 inches apart. The 
frames are riveted to the skin-stringer panels. 
The major frames are spaced 30 to 36 inches 
apart. The У. = 378 upper forward bulkhead is 
constructed of flat aluminum and formed 
sections riveted and bolted together; the lower 
is a machined section. The bulkhead provides 
the interface fitting for the nose section. 


The nose section contains large machined 
beams and struts. The structure for the nose 
landing gear wheel well consists of two support 
beams, two upper closeout webs, drag-link 
support struts, nose landing gear strut and 
actuator attachment fittings, and the nose 
landing gear door fittings. The left and right 
landing gear doors are attached by hinge 
fittings in the nose section. The doors are 
constructed of aluminum alloy honeycomb, and 
although the doors are the same length, the left 
door is wider than the right. Each door has an 
up-latch fitting at the forward and aft ends to 
lock the door closed when the gear is retracted, 
and each has a pressure seal in addition to a 
thermal barrier. Lead ballast in the nose wheel 
well and on the Х, = 293 bulkhead provides 
weight and center-of-gravity control. The nose 
wheel well accommodates 1,350 pounds of 
ballast, and the X, = 293 bulkhead 
accommodates a maximum of 1,971 pounds. 


The forward fuselage carries the basic body- 
bending loads (loads that have a tendency to 
change the radius of a curvature of the body) 
and reacts to nose landing gear loads. 
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Orbiter Dimensions 


The forward fuselage is covered with reusable 
insulation, except for the six windshields, two 
overhead windows, and side hatch window 
areas around the forward RCS jets. The nose 
cap is also a reusable thermal protection system 
constructed of reinforced carbon-carbon with 
thermal barriers at the nose cap-structure 
interface. 


provisions for installing antennas, deployable 
air data probes, and the door eyelet openings 
for the two star trackers. Two openings are 
required in the upper forward fuselage for star 
tracker viewing. Each opening has a door for 
environ-mental control. 


The forward orbiter/ET attach fitting is at the 
Хо = 378 bulkhead and the skin panel structure 


The forward fuselage skin has structural аң of the nose gear wheel well. Purge and vent 
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the forward fuselage and crew compartment 
around the windshield windows, overhead 
observation window, crew hatch window, and 
star tracker openings. The forward fuselage is 
isolated from the payload bay by a flexible 
membrane between the forward fuselage and 
crew compartment at X, - 582. 


The forward RCS module is constructed of 
conventional 2024 aluminum alloy skin-stringer 
panels and frames. The panels are composed of 
single-curvature, stretch-formed skins with 
riveted stringers. The frames are riveted to the 
skin-stringer panels. The forward RCS module 
is secured to the forward fuselage nose section 
and forward bulkhead of the forward fuselage 
with 16 fasteners, which permit the installation 
and removal of the module. The components of 
the forward RCS are mounted and attached to 
the module, which has a reusable thermal 
protection cover, in addition to thermal barriers 
installed around it and the RCS jet interfaces 
and the interface-attachment area to the 
forward fuselage. 


Crew Compartment 


The three-level crew compartment 15 
constructed of 2219 aluminum alloy plate with 
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framing welded together to create a pressure- 
tight vessel. The compartment has a side hatch 
for normal ingress and egress, a hatch into the 
airlock from the middeck, and a hatch from the 
airlock into the payload bay for extravehicular 
activity and payload bay access. The side hatch 
can be jettisoned. 


Redundant pressure window panes аге 
provided in the six forward windshields, the 
two overhead viewing windows, the two aft 
viewing windows, and the side hatch windows. 
Approximately 300 penetrations in the pressure 
shell are sealed with plates and fittings. A large 
removable panel in the aft bulkhead provides 
access to the interior of the crew compartment 
during initial fabrication and assembly. The 
compartment supports the ECLSS, avionics, 
GNC equipment, inertial measurement units, 
displays and controls, star trackers, and 
crew accommodations for sleeping, waste 
management, seats, and an optional galley. 


The crew compartment is supported within the 
forward fuselage at only four attach points to 
minimize the thermal conductivity between 
them. The two major attach points are located 
at the aft end of the crew compartment at the 
flight deck floor level. The vertical load reaction 
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link is on the centerline of the forward 
bulkhead. The lateral load reaction is on the 
lower segment of the aft bulkhead. 


The compartment is configured to 
accommodate a crew of four on the flight deck 
and three in the middeck. Тһе crew cabin 
arrangement consists of a flight deck, middeck, 
and lower level equipment bay. 


The crew compartment is pressurized to 14.7 + 
0.2 psia and is maintained at an 80-percent 
nitrogen and 20-percent oxygen composition by 
the ECLSS, which provides а shirt-sleeve 
environment for the flight crew. Тһе crew 
compartment is designed for 16 psia. 
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The crew compartment’s volume with the 
airlock in the payload bay is 2,553 cubic feet. 


Flight Deck 


The flight deck is the uppermost compartment 
of the cabin. The commander’s and pilot’s work 
stations are positioned side by side in the 
forward portion of the flight deck. These 
stations have controls and displays for 
controlling the vehicle throughout all mission 
phases. Directly behind and to the sides of the 
commander and pilot centerline are the mission 
specialist seats. 
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The aft flight deck has two overhead and aft 
viewing | windows for viewing orbital 
operations. Тһе aft flight deck station also 
contains displays and controls for executing 
attitude ог translational maneuvers Юг 
rendezvous, stationkeeping, docking, payload 
deployment and retrieval, payload monitoring, 
remote manipulator system controls and 
displays, payload bay door operations, and 
closed-circuit television operations. The aft 
flight deck is approximately 40 square feet. 
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The forward flight deck, which includes the 
center console and seats, is approximately 24 
square feet. However, the side console controls 
and displays add approximately 3.5 more 
square feet. If the center console is subtracted 
from the 24 square feet, this would amount to 
approximately 5.2 square feet. 


Middeck 


Directly beneath the flight deck is the middeck. 
Access to the middeck is through two interdeck 
openings, which measure 26 by 28 inches. 
Normally, the right interdeck opening is closed, 
and the left is open. A ladder attached to the 
left interdeck access allows easy passage in 1-g 
conditions. The middeck provides crew 
accommodations and contains three avionics 
equipment bays. The two forward avionics 
bays utilize the complete width of the cabin and 
extend into the middeck 39 inches from the 
forward bulkhead. The aft bay extends into the 
middeck 39 inches from the aft bulkhead on 
either side of the airlock hatch. Attached to the 
aft bay on the port side of the vehicle is the 
waste management compartment and closeouts 
which create a stowage compartment known as 
volume ЭВ. Just forward of the waste 
management system is the side hatch. The 
completely stripped middeck is approximately 
160 square feet; the gross mobility area is 
approximately 100 square feet. 


The side hatch in the middeck is used for normal 
crew ingress/egress and may be operated from 
within the crew cabin middeck or externally. It is 
attached to the crew cabin tunnel by hinges, a 
torque tube, and support fittings. The hatch 
opens outwardly 90° down with the orbiter 
horizontal or 90° sideways with the orbiter 
vertical. It is 40 inches in diameter and has a 10- 
inch clear-view window in the center of the 
hatch. The window consists of three panes of 
glass. The side hatch has a pressure seal that is 
compressed by the side hatch latch mechanisms 
when the hatch is locked closed. А thermal 
barrier of Inconel wire mesh spring with a 
ceramic fiber braided sleeve is installed between 
the reusable surface insulation tiles on the 
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forward fuselage and the side hatch. The total 
weight of the side hatch is 294 pounds. 


Depending on the mission requirements, bunk 
sleep stations and a galley can be installed in 
the middeck. In addition, three or four seats of 
the same type as the mission specialists’ seats 
on the flight deck can be installed in the 
middeck. 


The middeck also provides a stowage volume 
of 140 cubic feet. | Accommodations are 
included for dining, sleeping, maintenance, 
exercising, and data management. On the 
orbiter centerline, just aft of the forward 
avionics equipment bay, an opening in the 
ceiling provides access to Ње inertial 
measurement units. 


The middeck floor contains removable panels 
that provide access to the ECLSS equipment. 
The middeck equipment bay below Ше 
middeck floor houses the major components of 
the waste management and air revitalization 
systems, such as pumps, fans, lithium 
hydroxide carbon dioxide absorbers, heat 
exchangers, and ducting. This compartment 
has space for stowing lithium hydroxide 
canisters and five separate spaces for crew 
equipment stowage with a volume of 29.92 
cubic feet. 


Modular stowage lockers are used to store the 
flight crew’s personal gear, mission-necessary 
equipment, personal hygiene equipment, and 
experiments. There are 44 identical boxes that 
are 11 by 18 by 21 inches. 


An airlock located in the payload bay is made 
of aluminum and covered with thermal 
blankets. Three hatches are installed. One from 
the middeck, one to the payload bay and one 
everhead used while docked. The docking 
mechanism attached to the top of the airlock is 
operated by avionics mounted under a false 
floor in the bottom of the airlock. The airlock is 
mounted in the payload bay via truss. 


Normally, two extravehicular mobility units are 
stowed in the airlock. 
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Crew Compartment Middeck 


Forward Fuselage and Crew Compartment 
Windows 


The orbiter windows provide visibility for 
entry, landing, and on-orbit operations. For 
atmospheric flight, the flight crew needs 
forward, left, and right viewing areas. On-orbit 
mission phases require visibility for 
rendezvous, docking, and payload-handling 
operations. 


The six windows located at the forward flight 
deck commander and pilot stations provide 
forward, left, and right viewing. The two 
overhead windows and two payload-viewing 
windows at the aft station location on the flight 
deck provide rendezvous, docking, апа 
payload viewing. There is also a window in the 
middeck side hatch. 


The six platform-shaped forward windows are 
the thickest pieces of glass ever produced in the 
optical quality for see-through viewing. Each 
consists of three individual panes. The 
innermost pane, which is 0.625 of an inch thick, 
is constructed of tempered aluminosilicate glass 
to withstand the crew compartment pressure. 
Aluminosilicate glass is a low-expansion glass 
that can be tempered to provide maximum 
mechanical strength. The exterior of this pane, 
called a pressure pane, is coated with a red 
reflector coating to reflect the infrared (heat 
portion) rays while transmitting the visible 
spectrum. 
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The center pane is constructed of low- 
expansion, fused silica glass because of its high 
optical quality and excellent thermal shock 
resistance. This pane is 1.3 inches thick. 


The inner and outer panes are coated with a 
high-efficiency, anti-reflection coating to im- 
prove visible light transmission. These win- 
dows withstand a proof pressure of 8,600 psi at 
240° F and 0.017 relative humidity. 


The outer pane is made of the same material as 
the center pane and is 0.625 of an inch thick. 
The exterior is uncoated, but the interior is 
coated with high-efficiency, anti-reflection 
coating. The outer surface withstands 
approximately 800° F. 


Each of the six forward windows’ outer panes 
measures 42 inches diagonally, and the center 
and inner panes each measure 35 inches 
diagonally. The outer panes of the six forward 
windows are mounted and attached to the 
forward fuselage. The center and inner panes 


Outer shell 
forward fuselage 


Crew 
module 


3 panes and 2 cavities per window 


“7 


026.TIF 


Flight Deck Windows 
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are mounted and attached to the crew 
compartment. Redundant seals are employed 
on each window. No sealing/bonding 
compounds are used. 


The two overhead windows at the flight deck 
aft station are identical in construction to the six 
forward windows, except for thickness. The 
inner and center panes are 0.45 of an inch thick, 
and the outer pane is 0.68 of an inch thick. The 
outer pane is attached to the forward fuselage, 
and the center and inner panes are attached to 
the crew compartment. The two overhead 
windows’ clear view area is 20 by 20 inches. 
The left-hand overhead window provides the 
crew members with a secondary emergency 
egress. The inner and center panes open into 
the crew cabin, and the outer pane is jettisoned 
up and over the top of the orbiter. This 
provides a secondary emergency exit area of 20 
by 20 inches. 


On the aft flight deck, each of the two windows 
for viewing the payload bay consists of only 
two panes of glass, which are identical to the 
forward windows’ inner and center panes. The 
outer thermal panes are not installed. Each 
pane is 0.3 of an inch thick. The windows are 
14.5 by 11 inches. Both panes are attached to 
the crew compartment. 


The side hatch viewing window consists of 
three panes of glass identical to the six forward 
windows. The inner pane is 11.4 inches in 
diameter and 0.25 of an inch thick. The center 
pane is 11.4 inches in diameter and 0.5 of an 
inch thick. The outer pane is 15 inches in 
diameter and 0.3 of an inch thick. 
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During orbital operations, the large window 
areas of transparency expose the flight crew to 
sun glare; therefore, window shades are 
provided to preclude or minimize exposure. 
Shades are provided for all windows on the 
flight deck. The overhead window shades are 
stored in the middeck of the orbiter crew 
compartment. Attachment mechanisms and 
devices are provided for their installation at 
each window on the flight deck. 


The forward station window shades (W-1 
through W-6) are rolled up and stowed at the 
base of the windows. Solid shades are used on 
overhead windows (W-7 and W-8). 


The aft window shades (W-9 and W-10) are 
held in place via 0.63-inch-wide strip of Nomex 
Velcro around the perimeter of the shade. The 
shade is attached to the window by pressing the 
Velcro strip to the pile strip around the window 
opening. 


The side hatch window cover is permanently 
attached to the window frame and is hinged to 
allow opening and closing. 


Wing 


The wing is an aerodynamic lifting surface that 
provides conventional lift and control for the 
orbiter. The left and right wings consist of the 
wing glove, the intermediate section (which 
includes the main landing gear well), the torque 
box, the forward spar for mounting the reusable 
reinforced carbon-carbon leading edge structure 
thermal protection system, the wing/elevon 
interface, the elevon seal panels, and the 
elevons. 


The wing is constructed of conventional 
aluminum alloy with a multirib and spar 
arrangement with skin-stringer-stiffened covers 
or honeycomb skin covers. Each wing is ~60 
feet long at the fuselage intersection and has a 
maximum thickness of 5 feet. 


The forward wing box is an extension of the 
basic wing that aerodynamically blends the 
wing leading edge into the midfuselage wing 
glove. The forward wing box is a conventional 
design of aluminum ribs, aluminum tubes, and 
tubular struts. The upper and lower wing skin 
panels are stiffened aluminum. The leading 
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The intermediate wing section consists of the 
conventional aluminum multiribs апа 
aluminum tubes. The upper and lower skin 
covers аге constructed of aluminum 
honeycomb. А portion of the lower wing 
surface skin panel includes the main landing 
gear door. The intermediate section houses the 
main landing gear compartment and reacts to a 
portion of the main landing gear loads. A 
structural rib supports the outboard main 
landing gear door hinges and the main landing 
gear trunnion and drag link. The support for 
the inboard main landing gear trunnion and 
drag link attachment is provided by the 
midfuselage. The main landing gear door is 
conventional aluminum honeycomb. 


The four major spars are constructed of 
corrugated aluminum to minimize thermal 
loads. The forward spar provides the 
attachment for the thermal protection system 
reusable reinforced carbon-carbon leading edge 
structure. The rear spar provides the 
attachment interfaces for the elevons, hinged 
upper seal panels, and associated hydraulic and 
electrical system components. The upper and 
lower wing skin panels are stiffened aluminum. 
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elevons are conventional aluminum multirib 
and beam construction with aluminum 
honeycomb skins for compatibility with the 
acoustic environment and thermal interaction. 
The elevons are divided into two segments for 
each wing, and each segment is supported by 
three hinges. The elevons are attached to the 
flight control system hydraulic actuators at 
points along their forward extremities, and all 
hinge moments are reacted to at these points. 
Each elevon travels 33? up and 18? down 
(software limits). 


The transition. area on the upper surface 
between the torque box and the movable elevon 
consists of a series of hinged panels that 
provide a closeout of the wing-to-elevon cavity. 
These panels are of Inconel honeycomb 
sandwich construction outboard of wing station 
Yw = 3125 and of titanium honeycomb 
sandwich construction inboard of wing station 
Yw = 3125. The upper leading edge of each 
elevon incorporates titanium rub strips. The 
rub strips are of titanium honeycomb 
construction and are not covered with the 
thermal protection system reusable surface 
insulation. They provide the sealing surface 
area for the elevon seal panels. 


12-8 


Except the elevon seal panels, the exposed areas 
of the wings, main landing gear doors, and 
elevons are covered with reusable surface 
insulation thermal protection system materials. 
Thermal seals are provided on the elevon lower 
cove area along with thermal spring seals on the 
upper rub panels. Pressure seals and thermal 
barriers are provided on the main landing 
gear doors. 


The wing is attached to the fuselage with a 
tension bolt splice along the upper surface. A 
shear splice along the lower surface in the area 
of the fuselage carry-through completes the 
attachment interface. 


B manufacturing the wings for Discovery (OV- 
103) and Atlantis (OV-104), a weight reduction 
program resulted in a redesign of certain areas 
of the wing structure. An assessment of wing 
air loads was made from actual flight data that 
indicated greater loads on the wing structure. 
As a result, to maintain positive margins of 
safety during ascent, structural modifications 
were incorporated into certain areas of the 
wings. The modifications included the addition 
of doublers and stiffeners. 
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forward fuselage, aft fuselage, and wings. It 
supports the payload bay doors, hinges, tie- 
down fittings, forward wing glove, and various 
orbiter system components, and it forms the 
payload bay area. 


The forward and aft ends of the midfuselage are 
open, with reinforced skin and longerons 
interfacing with the bulkheads of the forward 
and aft fuselages. The midfuselage is primarily 
an aluminum structure 60 feet long, 17 feet 
wide, and 13 feet high. It weighs approximately 
13,502 pounds. 


The midfuselage skins are integrally machined 
by numerical control. The panels above the 
wing glove and the wings for the forward eight 
bays have longitudinal T-stringers. The five aft 
bays have aluminum honeycomb panels. The 
side skins in the shadow of the wing are also 
numerically control machined but have vertical 
stiffeners. 


The midfuselage structure is stabilized by 12 
mainframe assemblies. The assemblies consist 
of vertical side elements and horizontal 
elements. The side elements are machined; the 
horizontal elements are boron/aluminum tubes 
with bonded titanium end fittings. 


In the upper portion of the midfuselage are the 


sill and door longerons. The machined sill 
Xo1307 
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longerons not only make up the primary body- 
bending elements, but also take the longitudinal 
loads from payloads in the payload bay. The 
payload bay door longerons and associated 
structure are attached to the 13 payload bay 
door hinges. These hinges provide the vertical 
reaction from the payload bay doors. Five of 
the hinges react to the payload bay door shears. 
The sill longeron also provides the base support 
for the payload bay manipulator arm (if 
installed) and its stowage provisions, the Ku- 
band rendezvous antenna, the antenna base 
support and its stowage provisions, and the 
payload bay door actuation system. 


The side wall forward of the wing carry-through 
structure provides the inboard support for the 
main landing gear. The total lateral landing gear 
loads are reacted to by the midfuselage structure. 


The midfuselage also supports the two electrical 
wire trays that contain the wiring between the 
crew compartment and aft fuselage. 


Plumbing and wiring in the lower portion of the 
midfuselage are supported by fiberglass milk 
stools. The other exposed areas of the 
midfuselage are covered with the reusable 
surface insulation thermal protection system. 


Because of additional detailed analysis of actual 


flight data concerning descent stress thermal 
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gradient loads, torsional straps were added to 
the lower midfuselage stringers in bays 1 
through 11. The torsional straps tie all stringers 
together similarly to a box section, which 
eliminates rotational (torsional) capabilities to 
provide positive margins of safety. 


Also, because of additional detailed analysis of 
actual flight data during descent, room- 
temperature vulcanizing silicone rubber 
material was bonded to the lower midfuselage 
from bay 4 through 12 to act as a heat sink and 
distribute temperatures evenly across the 
bottom of the midfuselage, which reduces 
thermal gradients and ensures positive margins 
of safety. 


Aft Fuselage 


The aft fuselage consists of an outer shell, thrust 
structure, and internal secondary structure. It is 
approximately 18-feet-long, 22-feet-wide, and 
20-feet-high. 


The aft fuselage supports and interfaces with 
the left-hand and right-hand aft OMS/RCS 
pods, the wing aft spar, midfuselage, 
orbiter/external tank rear attachments, main 
engines, aft heat shield, body flap, vertical tail, 
and two T-0 launch umbilical panels. 
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The aft fuselage provides the load path to the 
midfuselage main longerons, main wing spar 
continuity across the forward bulkhead of the 
aft fuselage, structural support for the body 
flap, and structural housing around all internal 
systems for protection from operational 
environments (pressure, thermal, and acoustic) 
and controlled internal pressures during flight. 


The forward bulkhead closes off the aft fuselage 
from the midfuselage and is composed of 
machined and beaded sheet metal aluminum 
segments. The upper portion of the bulkhead 
attaches to the front spar of the vertical tail. 


The internal thrust structure supports the three 
SSMEs. The upper section of the thrust 
structure supports the upper SSME, and the 
lower section supports the two lower SSMEs. 
The internal thrust structure includes the 
SSMES, load reaction truss structures, engine 
interface fittings, and the actuator support 
structure. It supports the SSMEs and the 55МЕ 
low-pressure turbopumps and propellant lines. 
The two orbiter/external tank aft attach points 
interface at the longeron fittings. 


The internal thrust structure is composed 
mainly of 28 machined, diffusion-bonded truss 
members. In diffusion bonding, titanium strips 
are bonded together under heat, pressure, and 
time. This fuses the titanium strips into a single 
hollow, homogeneous mass that is lighter and 
stronger than a forged part. In looking at the 
cross section of a diffusion bond, no weld line is 
visible. It is a homogeneous parent metal, yet 
composed of pieces joined Бу diffusion 
bonding. (In OV-105, the internal thrust 
structure is a forging.) In selected areas, the 
titanium construction is reinforced with 
boron/epoxy tubular struts to minimize weight 
and add stiffness. 


The upper thrust structure of the aft fuselage is 
of integral-machined aluminum construction 
with aluminum frames except for the vertical 
fin support frame, which is titanium. The skin 
panels are integrally machined aluminum and 
attach to each side of the vertical fin to react to 
drag and torsion loading. 


The outer shell of the aft fuselage is constructed 
of integral-machined aluminum. | Various 
penetrations are provided in the shell for access 
to installed systems. The exposed outer areas of 
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the aft fuselage are covered with reusable 
thermal protection system. 


The secondary structure of the aft fuselage is of 
conventional aluminum construction except 
that titanium and fiberglass are used for thermal 
isolation of equipment. The aft fuselage secon- 
dary structures consist of brackets, buildup 
webs, truss members, and machined fittings, as 
required by system loading and support 
constraints. Certain system components, such 
as the avionics shelves, are shock-mounted to 
the secondary structure. Тһе secondary 
structure includes support provisions for the 
auxiliary power units, hydraulics, ammonia 
boiler, flash evaporator, and electrical wire runs. 


The two ET umbilical areas interface with the 
orbiter’s two aft ET attach points and the ET’s 
liquid oxygen and hydrogen feed lines and 
electrical wire runs. The umbilicals are 
retracted, and the umbilical areas are closed off 
after ET separation by an electromechanically 
operated beryllium door at each umbilical. 
Thermal barriers are employed at each 
umbilical door. The exposed area of each 
closed door is covered with reusable surface 
insulation. 


The aft fuselage heat shield and seal provide a 
closeout of the orbiter aft base area. The aft 
heat shield consists of a base heat shield of 
machined aluminum. Attached to the base heat 
shield are domes of honeycomb construction 
that support flexible апа sliding seal 
assemblies. The engine-mounted heat shield is 
of Inconel honeycomb construction апа 15 
removable for access to the main engine power 
heads. The heat shield is covered with a 
reusable thermal protection system except for 
the Inconel segments. 


Orbital Maneuvering System/Reaction 
Control System (OMS/RCS) Pods 


The OMS/RCS left- and right-hand pods are 
attached to the upper aft fuselage left and right 
sides. Each pod is fabricated primarily of 
graphite epoxy composite and aluminum. Each 
pod is 21.8 feet long and 11.37 feet wide at its 
aft end and 8.41 feet wide at its forward end, 
with a surface area of approximately 435 square 
feet. Each pod 18 divided into two 
compartments: the OMS and the RCS housings. 
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Aft Orbital Maneuvering System/Reaction Control System Pod 


Each pod houses all the OMS and RCS 
propulsion components and is attached to the 
aft fuselage with 11 bolts. The pod skin panels 
are graphite epoxy honeycomb sandwich. The 
forward and aft bulkhead aft tank support 
bulkhead and floor truss beam are machined 
aluminum 2124. The centerline beam is 2024 
aluminum sheet with titanium stiffeners and 
graphite epoxy frames. The OMS thrust 
structure is conventional 2124 aluminum 
construction. The cross braces are aluminum 
tubing, and the attach fittings at the forward 
and aft fittings are 2124 aluminum. The 
intermediate fittings are corrosion-resistant 
steel. The КС5 housing, which attaches to the 
OMS pod structure, contains the RCS jets and 
associated propellant feed lines. Тһе RCS 
housing is constructed of aluminum sheet 
metal, including flat outer skins. The curved 
outer skin panels are graphite epoxy honeycomb 
sandwich. Doors in the skins (24) provide access 
to the OMS and RCS and attach points. 


The exposed areas of the OMS/RCS pods are 
covered with a reusable thermal protection 
system, and a pressure and thermal seal is 
installed at the OMS/RCS pod aft fuselage 
interface. Thermal barriers are installed, and 
they interface with the RCS jets and reusable 
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thermal protection system. The pods will 
withstand 162-decibel acoustic noise and a 
temperature range from minus 170° to plus 135°F. 


Body Flap 


The body flap thermally shields the three 
SSMEs during entry and provides the orbiter 
with pitch control trim during its atmospheric 
flight after entry. 


The body flap is an aluminum structure 
consisting of ribs, spars, skin panels, and a 
trailing edge assembly. The main upper and 
lower forward honeycomb skin panels are 
joined to the ribs, spars, and honeycomb trailing 
edge with structural fasteners. The removable 
upper forward honeycomb skin panels 
complete the body flap structure. 


The upper skin panels aft of the forward spar 
and the entire lower skin panels аге 
mechanically attached to the ribs. The forward 
upper skin consists of five removable access 
panels attached to the ribs with quick-release 
fasteners. The four integral-machined alumi- 
num actuator ribs provide the aft fuselage 
interface through self-aligning bearings. Two 
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Body Flap 


bearings are located in each rib for attachment 
to the four rotary actuators located in the aft 
fuselage, which are controlled by the flight 
control system and the hydraulically actuated 
rotary actuators. The remaining ribs consist of 
eight stability ribs and two closeout ribs 
constructed of chemically milled aluminum 
webs bonded to aluminum honeycomb core. 
The forward spar web is of chemically milled 
sheets with flanged holes and stiffened beads. 
The spar web is riveted to the ribs. The trailing 
edge includes the rear spar, which is composed 
of piano-hinge half-cap angles, chemically 
milled skins, honeycomb aluminum core, 
closeouts, and plates. The trailing edge attaches 
to the upper and lower forward panels by the 
piano-hinge halves and hinge pins. Two 
moisture drain lines and one hydraulic fluid 
drain line penetrate the trailing edge 
honeycomb core for horizontal and vertical 
drainage. 


The body flap is covered with a reusable 
thermal protection system and an articulating 
pressure and thermal seal to its forward cover 
area on the lower surface of the body flap to 
block heat and air flow from the structures. 


1.2-13 


12-1ЗОКВІТЕК STRUCTURE 


Vertical Tail 


The vertical tail consists of a structural fin 
surface, the rudder/speed brake surface, a tip, 
and a lower trailing edge. The rudder splits 
into two halves to serve as a speed brake. 


The vertical tail structure fin is made of 
aluminum. The main torque box is constructed 
of integral-machined skins and strings, ribs, and 
two machined spars. The fin is attached by two 
tension tie bolts at the root of the front spar of 
the vertical tail to the forward bulkhead of the 
aft fuselage and by eight shear bolts at the root 
of the vertical tail rear spar to the upper 
structural surface of the aft fuselage. 


The rudder/speed brake control surface is 
made of conventional aluminum ribs and spars 
with aluminum honeycomb skin panels and is 
attached through rotating hinge parts to the 
vertical tail fin. 


The lower trailing edge area of the fin, which 
houses the rudder/speed brake power drive 
unit, is made of aluminum honeycomb skin. 
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Vertical Tail 


The hydraulic power drive unit/mechanical 
rotary actuation system drives left- and right- 
hand drive shafts in the same direction for 
rudder control of plus or minus 27?. For speed 
brake control, the drive shafts turn in opposite 
directions for a maximum of 49.3? each. The 
rotary drive actions are also combined for joint 
rudder/speed brake control The hydraulic 
power drive unit is controlled by the orbiter 
flight control system. 


The vertical tail structure is designed for a 163- 
decibel acoustic environment with a maximum 
temperature of 350? F. 


All-Inconel honeycomb conical seals house the 
rotary actuators and provide a pressure and 
thermal seal that withstands a maximum of 
1,200? F. 


Тһе split halves of the rudder panels and 
trailing edge contain a thermal barrier seal. 


The vertical tail and rudder/speed brake are 
covered with a reusable thermal protection 
system. A thermal barrier is also employed at 
the interface of the vertical stabilizer and aft 
fuselage. 
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Orbiter Passive Thermal Control 


A passive thermal control system helps 
maintain the temperature of the orbiter 
spacecraft, systems, and components within 
their temperature limits. This system uses 
available orbiter heat sources and sinks 
supplemented by insulation blankets, thermal 
coatings, and thermal isolation methods. 
Heaters are provided on components and 
systems in areas where passive thermal control 
techniques are not adequate. (The heaters are 
described under the various systems.) 


The insulation blankets are of two basic types: 
fibrous bulk and multilayer. The bulk blankets 
are fibrous materials with a density of 2 pounds 
per cubic foot and a sewn cover of reinforced 
acrylic film Kapton. The cover material has 
13,500 holes per square foot for venting. 
Acrylic film tape is used for cutouts, patching, 
and reinforcements. Tufts throughout the 
blankets minimize billowing during venting. 


The multilayer blankets are constructed of 
alternate layers of perforated acrylic film 
Kapton reflectors and Dacron net separators. 
There are 16 reflector layers in all, the two cover 
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halves counting ав two layers. Covers, tufting, 
and acrylic film tape are similar to that used for 
the bulk blankets. 


Thermal Protection System 


The thermal protection system (TPS) consists of 
various materials applied externally to the outer 
structural skin of the orbiter to maintain the 
skin within acceptable temperatures, primarily 
during the entry phase of the mission. The 
orbiter’s outer structural skin is constructed 
primarily of aluminum and graphite epoxy. 


During entry, the TPS materials protect the 
orbiter outer skin from temperatures above 
350° F. In addition, they are reusable for 100 
missions with refurbishment and maintenance. 
These materials perform in temperature ranges 
from minus 250° F in the cold soak of space to 
entry temperatures that reach nearly 3,000° F. 
The TPS also sustains the forces induced by 
deflections of the orbiter airframe as it responds 
to the various external environments. Because 
the TPS is installed on the outside of the orbiter 
skin, it establishes the aerodynamics over the 
vehicle in addition to acting as the heat sink. 


Orbiter interior temperatures also are controlled 
by internal insulation, heaters, and purging 
techniques in the various phases of the mission. 


The TPS is a passive system consisting of 
materials selected for stability at high 
temperatures and weight efficiency. These 
materials are as follows: 


1. Reinforced carbon-carbon (RCC) is 
used on the wing leading edges, the 
nose сар, including ап area 
immediately aft of the nose cap on the 
lower surface (chine panel), and the 
immediate area around the forward 
orbiter/ET structural attachment. 


RCC protects areas where 
temperatures exceed 2,300° F during 
entry. 


2. Black high-temperature reusable 
surface insulation (HRSI) tiles аге 
used in areas on the upper forward 
fuselage, including around the 
forward fuselage windows, the entire 
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underside of the vehicle where RCC is 
not used, portions of the OMS/RCS 
pods, the leading and trailing edges of 
the vertical stabilizer, wing glove 
areas, elevon trailing edges adjacent 
to the RCC on the upper wing surface, 
the base heat shield, the interface with 
wing leading edge RCC, and the 
upper body flap surface. The HRSI 
tiles protect areas where temperatures 
are below 2,300° F. These tiles have a 
black surface coating necessary for 
entry emittance. 


Black tiles called fibrous refractory 
composite insulation (FRCI) were 
developed later in the TPS program. 
FRCI tiles replace some of the HRSI 
tiles in selected areas of the orbiter. 


Low-temperature reusable surface 
insulation (LRSI) white tiles are used 
in selected areas of the forward, mid-, 
and aft fuselages, vertical tail, upper 
wing, and OMS/RCS pods. These 
tiles protect areas where temperatures 
are below 1,200° F. These tiles have a 
white surface coating to provide 
better thermal characteristics on orbit. 


After the initial delivery of Columbia, 
an advanced flexible reusable surface 
insulation (AFRSI) was developed. 
This material consists of sewn 
composite quilted fabric insulation 
batting between two layers of white 
fabric that are sewn together to form a 
quilted blanket. AFRSI was used on 
Discovery and Atlantis to replace the 
vast majority of the LRSI tiles. 
Following its seventh flight, Columbia 
also was modified to replace most of 
the LRSI tiles with AFRSI. The AFRSI 
blankets provide improved 
producibility and durability, reduced 
fabrication and installation time and 
costs, and a weight reduction over 
that of the LRSI tiles. The AFRSI 
blankets protect areas where 
temperatures are below 1,200° F. 


White blankets made of coated 
Nomex felt reusable surface insulation 
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(FRSI) are used on the upper payload 
bay doors, portions of the 
midfuselage and aft fuselage sides, 
portions of the upper wing surface, 
and a portion of the OMS/RCS pods. 
The FRSI blankets protect areas where 
temperatures are below 700° F. 


Additional materials are used in other 
special areas. These materials are 
thermal panes for the windows, metal 
for the forward RCS fairings and 
elevon seal panels on the upper wing 
to elevon interface, a combination of 
white- and black-pigmented silica 
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cloth for thermal barriers and gap 
fillers around operable penetrations, 
such as main and nose landing gear 
doors, egress and ingress flight crew 
side hatch, umbilical doors, elevon 
cove, forward RCS, RCS jets, 
midfuselage vent doors, payload bay 
doors, rudder/speed brake, 
OMS/RCS pods, and gaps between 
TPS tiles in high differential pressure 
areas, and room-temperature 
vulcanizing material for the thick 
aluminum T-0 umbilicals on the sides 
of the orbiter aft fuselage. 


13 EXTERNAL TANK 
CONTENTS 


Liquid Oxygen Tank 
Intertank 


Liquid Hydrogen Tank 
Thermal Protection System 
Hardware and Instrumentation 


The external tank (ET) contains the liquid 
hydrogen fuel and liquid oxygen oxidizer and 
supplies them under pressure to the three 
SSMEs in the orbiter during ascent. When the 
SSMEs are shut down, the ET is jettisoned and 
enters the Earth’s atmosphere, where it breaks 
up and impacts in a remote ocean area. ET 
impact zones for direct insertion are discussed 
in Section 1.1. 


The largest and heaviest (when loaded) element 
of the space shuttle, the ET, has three major 
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components: the forward liquid oxygen tank, an 
unpressurized intertank that contains most of 
the electrical components, and the aft liquid 
hydrogen tank. 


Since the STS-91 mission, a super lightweight 
external tank (SLWT) has been used. This tank 
weighs approximately 58,500 pounds inert. The 
SLWT is 7500 pounds lighter than the 
lightweight tank (no longer used) and this 
reduction provides ап increased payload 
capability over prior configurations. 


The ET is attached to the orbiter at one forward 
attachment point and two aft points. In the aft 
attachment area, there are also umbilicals that 
carry fluids, gases, electrical signals, and 
electrical power between the tank and the 
orbiter. Electrical signals and controls between 
the orbiter and the two SRBs also are routed 
through those umbilicals. 


Propellant feed, 
pressurized lines 
and electrical 
umbilicals 


Intertank Т-0 
umbilical plate 


Length 153.8 feet 
Diameter 27.6 feet 


Average gross lift-off weight (SLWT) 1,658,217 pounds 
Inert weight (SLWT) 58,500 pounds 
Liquid oxygen maximum 1,376,240 pounds 
144,857 gallons 
230,302 gallons 
389,770 gallons 


Liquid hydrogen maximum 


Average total LO2/H2 
Burn rate (104%) 


532,776 gallons 
64,957 gallons/min 

1,083 gallons/sec 
(all weights/rates are approximate) 
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Liquid Oxygen Tank 


The liquid oxygen tank is an aluminum 
monocoque structure composed of a fusion- 
welded assembly of preformed, chem-milled 
gores, panels, machined fittings, and ring 
chords. It operates in a pressure range of 20 to 
22 psig. The tank contains anti-slosh and anti- 
vortex provisions to minimize liquid residuals 
and damp fluid motion. The tank feeds into a 
17-inch-diameter feed line that conveys the 
liquid oxygen through the intertank, then 
outside the ET to the aft right-hand ET/orbiter 
disconnect umbilical. The 17-inch-diameter 
feed line permits liquid oxygen to flow at 
approximately 2,787 pounds per second with 
the SSMEs operating at 104 percent or permits a 
maximum flow of 17,592 gallons per minute. 
The liquid oxygen tank’s double-wedge nose 
cone reduces drag and heating, contains 
electrical system components, and serves as a 
lightning rod. The liquid oxygen tank's volume 
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is 19,563 НЗ. It is 331 inches in diameter, 592 
inches long and weighs 12,000 pounds empty. 


Intertank 


The intertank is a steel/aluminum semimonoco- 
que cylindrical structure with flanges on each 
end for joining the liquid oxygen and liquid 
hydrogen tanks. The intertank houses ET in- 
strumentation components and provides an 
umbilical plate that interfaces with the ground 
facility arm for purge gas supply, hazardous 
gas detection, and hydrogen gas boiloff during 
ground operations. It consists of mechanically 
joined skin, stringers, and machined panels of 
aluminum alloy. The intertank is vented during 
flight. The intertank contains the forward SRB- 
ET attach thrust beam and fittings that 
distribute the SRB loads to the liquid oxygen 
and liquid hydrogen tanks. The intertank is 270 
inches long, 331 inches in diameter, and weighs 
12,100 pounds. 
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Liquid Hydrogen Tank Structure 


Liquid Hydrogen Tank 


The liquid hydrogen tank is an aluminum 
semimonocoque structure of fusion-welded 
barrel sections, five major ring frames, and 
forward and aft ellipsoidal domes. 16 
operating pressure range is 32 to 34 psia. The 
tank contains an anti-vortex baffle and siphon 
outlet to transmit the liquid hydrogen from the 
tank through a 17-inch line to the left aft 
umbilical. The liquid hydrogen feed line flow 
rate is 465 pounds per second with the SSMEs 
at 104 percent or a maximum flow of 47,365 
gallons per minute. At the forward end of the 
liquid hydrogen tank is the ET/orbiter forward 
attachment pod strut, and at its aft end are the 
two ET/orbiter aft attachment ball fittings as 
well as the aft SRB-ET stabilizing strut 
attachments. The liquid hydrogen tank is 331 
inches in diameter, 1,160 inches long, and has a 
volume of 53,518 ft? and a dry weight of 29,000 
pounds. 


Thermal Protection System 


The ET thermal protection system consists of 
sprayed-on foam insulation and premolded 
ablator materials. The system also includes the 
use of phenolic thermal insulators to preclude 
air liquefaction. Thermal isolators are required 
for liquid hydrogen tank attachments to 
preclude the liquefaction of air-exposed 
metallic attachments and to reduce heat flow 
into the liquid hydrogen. Тһе thermal 
protection system weighs 4,823 pounds. 


Hardware and Instrumentation 


The external hardware, ET/orbiter attachment 
fittings, umbilical fittings, electrical, and range 
safety system weigh 9,100 pounds. 


Each propellant tank has a vent and relief valve 
at its forward end. This dual-function valve 
can be opened by ground support equipment 
for the vent function during prelaunch and can 
open during flight when the ullage pressure of 
the liquid hydrogen tank reaches 36 psig, or 
the ullage pressure of the liquid oxygen tank 
reaches 31 psig. 


There are eight propellant-depletion sensors, 
four each for fuel and oxidizer. The fuel- 
depletion sensors are located in the bottom of 
the fuel tank. The oxidizer sensors are 
mounted in the orbiter liquid oxygen feed line 
manifold downstream of the feed line 
disconnect. During SSME burns, the orbiter 
GPCs constantly compute the instantaneous 
mass of the vehicle due to the usage of the 
propellants. Normally, main engine cutoff 
(MECO) is based on a predetermined velocity; 
however, once past a flight-specific arming 
mass, if any two of the fuel or oxidizer sensors 
sense a dry condition, the engines will be shut 
down. 


The locations of the liquid oxygen sensors 
allow the maximum amount of oxidizer to be 
consumed in the engines, while allowing 
sufficient time to shut down the engines before 
the oxidizer pumps cavitate (run dry). In 
addition, 1,100 pounds of liquid hydrogen are 
loaded over and above that required by the 6:1 
oxidizer/fuel engine mixture ratio. The excess 
hydrogen ensures that the propellant ratio 
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during MECO is fuel-rich. High temperatures 
during an oxidizer-rich engine shutdown can 
cause severe erosion of engine components. 


Four pressure transducers located at the top of 
the liquid oxygen and liquid hydrogen tanks 
monitor the ullage pressures. 


Each of the two aft ET umbilical plates mate 
with a corresponding plate on the orbiter. The 
plates help maintain alignment among the 
umbilicals. Physical strength at the umbilical 
plates is provided by bolting corresponding 
umbilical plates together. When the orbiter 
GPCs command external tank separation, the 
bolts are severed by pyrotechnic devices. 


Тһе ET has five propellant umbilical valves 
that interface with orbiter umbilicals: two for 
the liquid oxygen tank and three for the liquid 
hydrogen tank. One of the liquid oxygen tank 
umbilical valves is for liquid oxygen, the other 
for gaseous oxygen. 
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A swing-arm-mounted cap to the fixed service 
structure covers the oxygen tank vent on top of 
the ET during the countdown and is retracted 
about 2 minutes before lift-off. Тһе сар 
siphons off oxygen vapor that threatens to 
form ісе on the ET, thus protecting the orbiter’s 
TPS during launch. 


The liquid hydrogen tank umbilical has two 
valves for liquid and one for gas. Тһе 
intermediate-diameter liquid hydrogen 
umbilical is a recirculation umbilical used only 
during the liquid hydrogen chill-down 
sequence during prelaunch. 


The ET also has two electrical umbilicals that 
carry electrical power from the orbiter to the 
tank and the two SRBs and_ provide 
information from the SRBs and ET to the 
orbiter. 
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SRB Ignition 
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The two solid rocket booster (SRBs) are the 
largest solid-propellant motors ever flown and 
the first ever designed for reuse. 


Prelaunch, each booster is attached to the 
mobile launch platform at the aft skirt by four 
bolts and nuts that are severed by small 
explosives at liftoff. The ET is then attached to 
the two SRBs at each SRB’s aft frame by two 
lateral sway braces and a diagonal attachment. 
The forward end of each SRB is attached to the 
ET at the SRB’s forward skirt. The orbiter is 
then mated to the ET/SRB stack. In the end, the 
two SRBs carry the entire weight of the stack 
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and transmit the weight load through their 
structure to the mobile launch platform. 


At liftoff, the SRBs are ignited after the three 
SSMEs’ thrust level is verified. Each booster 
generates a thrust of approximately 3,300,000 
Ibs (at sea level), providing 71.4 percent of the 
thrust at liftoff and during first-stage ascent, 
lifting the space shuttle off the pad and up to an 
altitude of about 150,000 ft (or 24 nm). The 
solid propellant is spent after burning for a little 
more than two minutes, at which point the SRBs 
are jettisoned. Parachutes bring the SRBs back 
down to Earth intact, impacting the ocean 
approximately 122 nm downrange. 


Each SRB measures about 149 ft in length and 
12 ft in diameter and weighs approximately 
1,300,000 Ibs at launch (approximately 1,100,000 
Ibs of that being propellant). 


The propellant mixture in each SRB motor 
consists of an ammonium perchlorate (oxidizer, 
69.6 percent by weight), aluminum (fuel, 
16 percent), iron oxide (a catalyst, 0.4 percent), a 
polymer (a binder that holds the mixture 
together, 12.04 percent), and an epoxy curing 
agent (1.96 percent). The propellant is an 
11-point star-shaped perforation in the forward 
motor segment and a double-truncated-cone 
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perforation in each of the aft segments and aft 
closure. This configuration provides high 
thrust at ignition and then reduces the thrust by 
approximately a third some 50 seconds after 
liftoff. This prevents overstressing the vehicle 
during maximum dynamic pressure. 


The SRBs are used as matched pairs, and each is 
made up of four solid rocket motor segments. 
The pairs are matched by loading each of the 
four motor segments in pairs from the same 
batches of propellant ingredients to minimize 
any thrust imbalance. The segmented-casing 
design assures maximum flexibility in fabrica- 
tion and ease of transportation and handling. 
Each segment is shipped to the launch site on a 
heavy-duty rail car with a specially built cover. 


Each nozzle has an expansion ratio of 7.72:1 and 
has a carbon cloth liner that erodes and chars 
during firing. Each nozzle is gimbaled for 
thrust vector control using а convergent- 
divergent, movable design in which an aft 
pivot-point flexible bearing is the gimbal 
mechanism. To actuate the gimbals, each SRB 
has its own redundant auxiliary power unit and 
hydraulic pumps. Тһе аП-ахіѕ gimbal 
capability is 8°. 


Each SRB has two integrated electronic 
assemblies (IEA), one in the forward skirt and 
one in the ET/SRB attach ring. After burnout, 
the forward IEA initiates the release of the nose 
cap and frustum. The aft IEA connects with the 
forward IEA and the orbiter avionics systems 
for SRB ignition commands and nozzle thrust 
vector control. Each IEA has a multiplexer/ 
demultiplexer, which sends or receives more 
than one message, signal, or unit of information 
on a single communication channel. 


Eight booster separation motors (four in the 
nose frustum and four in the aft skirt) of each 
SRB burn for 1.02 seconds at SRB separation. 
Each separation motor is 31.1 inches long and 
12.8 inches in diameter. 
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The recovery crew retrieves the  SRBs, 
frustum/drogue chutes, and main parachutes. 
The SRB nose caps and nozzle extensions are 
not recovered. The nozzles are plugged, the 
solid rocket motors are dewatered, and the 
SRBs are towed back to the launch site. Once 
there, each booster is disassembled and washed 
with fresh and deionized water to limit salt 
water corrosion. The motor segments, igniter, 
and nozzle are then shipped back to the 
manufacturer for refurbishment. 


Following the Challenger accident, detailed 
structural analyses were performed on critical 
structural elements of the SRB. Опе such 
element was the attach ring where the SRBs 
connect to the ET. Areas of distress were noted 
in some of the fasteners where the ring attaches 
to the SRB motor case. This situation was 
attributed to the high loads encountered during 
water impact. The attach ring was redesigned 
to correct the situation and ensure higher 
strength margins during ascent. Instead of 
forming a “C” and encircled the motor case 
270°, the attach ring now encircles the motor 
case a complete 360°. 


Additionally, special structural tests performed 
on the aft skirt discovered an anomaly in a 
critical weld between the hold-down post and 
skin of the skirt. This led to the addition of 
reinforcement brackets and fittings in the aft 
ring of the skirt. 


The redesigned attach ring and the addition of 
the brackets and fittings increased the SRB’s 
weight by approximately 450 pounds. 
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Hold-Down Posts 


Each SRB has four hold-down posts that fit into 
corresponding support posts on the mobile 
launch platform. Hold-down bolts hold the 
SRB and launcher platform posts together. Each 
bolt has a nut at each end, but only the top nut 
is frangible. The top nut contains two NASA 
Standard Initiator detonators (NSIs), which are 
ignited at solid rocket motor ignition 
commands. 
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When the two NSI detonators are ignited at 
each hold-down, the hold-down bolt travels 
downward because of a combination of forces; 
the release of tension in the bolt (pretensioned 
before launch), NSI detonator gas pressure, and 
gravity. Тһе bolt is stopped by the stud 
deceleration stand, which contains sand. The 
SRB bolt is 28 inches long and is 3.5 inches in 
diameter. The frangible nut is captured in a 
blast container. 


The solid rocket motor ignition commands are 
issued by the orbiter's computers through the 
master events controllers to the hold-down 
pyrotechnic initiator controllers (PICs) on the 
mobile launch platform. They provide the 
ignition to the hold- down NSI detonators. The 
launch processing system monitors the SRB 
hold-down РГС$ for low voltage during the last 
16 seconds before launch. PIC low voltage will 
initiate a launch hold. 


5КВ Ignition 


During the final ordnance installation and 
connection (performed a few days prior to 
launch) the SRB ignition S&A device's safing 
pin is removed from the S&A device. This 
allows the S&A device to be armed remotely 
during final countdown. Five minutes before 
launch, the SRB S&A device is rotated to the 
arm position. The solid rocket motor ignition 
commands are issued when the three SSMEs are 
at or above 90-percent rated thrust, no SSME 
fail and/or SRB ignition PIC low voltage is 
indicated, and there are no holds from the 
launch processing system. 


The solid rocket motor ignition commands are 
sent by the orbiter computers through the 
master events controllers (MECs) to the S&A 
device's NSI detonators in each SRB. А PIC 
single-channel capacitor discharge device 
controls the firing of each pyrotechnic device. 
Three signals must be present simultaneously 
for the PIC to generate the pyrotechnic firing 
output. These signals, arm, fire 1, and fire 2, 
originate in the GPCs and are transmitted to the 
MECs. The МЕС» reformat them to 28-volt dc 
signals for the PICs. The arm signal charges the 
PIC capacitor to 40 volts ас (minimum of 20 
volts dc). 


1. GENERAL DESCRIPTION 
1.4 Solid Rocket Boosters 


The fire 1 and 2 commands cause the redundant 
NSI detonators to fire through a thin barrier seal 
down a flame tunnel. This ignites a pyrotechnic 
booster charge, which is retained in the S&A 
device behind a perforated plate. The booster 
charge ignites the propellant in the igniter 
initiator, and combustion products of this 
propellant ignite the solid rocket motor 
initiator, which fires down the length of the 
solid rocket motor igniting the solid rocket 
motor propellant. 


Nose cap 
(Ау жо Altitude switch 


A 2, ————— Frustum 


a ——— — Frustum location 
aids 


Range 
safety system —~ 


Integrated electronic 
assembly (forward) 
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assembly 
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Integrated External tank 
electronic SRB interface 
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separation motors 


Solid Rocket Booster-Exploded View 


The GPC launch sequence also controls certain 
critical valves in the main propulsion system 
(MPS) and monitors Ше  engine-ready 
indications from the SSMEs. The MPS start 
commands are issued by the GPCs at 
6.6 seconds before launch (staggered start— 
engine 3, engine 2, engine 1—all approximately 
within 0.25 second), and the sequence monitors 
the thrust buildup of each engine. All three 
SSMEs must reach the required 90-percent 
thrust within 3 seconds; otherwise, an orderly 
shutdown is commanded, and safing functions 
are initiated. 
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Normal thrust buildup to the required 90- 
percent thrust level will result in the SSMEs 
being commanded to the liftoff position 
3 seconds before liftoff, as well as the fire 1 
command being issued to arm the SRBs. Also at 
3 seconds before liftoff, the vehicle base bending 
load modes are allowed to initialize (movement 
of approximately 25.5 inches measured at the 
tip of the external tank, with movement 
towards the external tank). 


SRB ignition sequence occurs as follows: 


e PIC initiated ignition of 5&А pyrotechnic 
charge 


е S&A charge ignites the Initiator propellant 


e Initiator propellant ignites rocket motor 
ignitor 

e Ignitor propellant ignites booster motor 
propellant 


At T-0, the two SRBs are ignited, the frangible 
nuts at each of the eight hold down studs are 
separated, the onboard master timing unit, 
event timer, and mission event timers are 
started, the three SSMEs are at 100 percent and 
launch is initiated. The ground launch sequence 
is now terminated. 


At 0.23 seconds after liftoff, booster chamber 
pressure reaches 5635 psia and liftoff 
commences. At 0.6 seconds after liftoff, booster 
chamber pressure reaches maximum limit, 
nominally 914 psia. 


The solid rocket motor thrust profile is tailored 
to reduce thrust during the maximum dynamic 
pressure region. 


Electrical Power Distribution 


Electrical power distribution in each SRB 
consists of orbiter-supplied main dc bus power 
to each SRB via SRB buses A, B, and C. Orbiter 
main dc buses A, B, and C supply main dc bus 
power to corresponding SRB buses A, B, and C. 
In addition, orbiter main dc bus C supplies 
backup power to SRB buses A and B, and 
orbiter bus B supplies backup power to SRB bus 
C. This electrical power distribution arrange- 
ment allows all SRB buses to remain powered in 
the event one orbiter main bus fails. 
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The nominal dc voltage is 28 volts dc, with an 
upper limit of 32 volts dc and a lower limit of 24 
volts dc. 


Hydraulic Power Units 


There are two self-contained, independent 
hydraulic power units (HPUs) on each SRB. 
Each HPU consists of an auxiliary power unit 
(APU), fuel supply module, hydraulic pump, 
hydraulic reservoir, and hydraulic fluid mani- 
fold assembly. Тһе APUs are fueled by 
hydrazine and generate mechanical shaft power 
to a hydraulic pump that produces hydraulic 
pressure for the SRB hydraulic system. The two 
separate HPUs and two hydraulic systems are 
located on the aft end of each SRB between the 
SRB nozzle and aft skirt. The HPU components 
are mounted on the aft skirt between the rock 
and tilt actuators. The two systems operate 
from 28 seconds before liftoff until SRB 
separation. Тһе two independent hydraulic 
systems are connected to the rock and tilt servo 
actuators. 


The APU controller electronics are located in 
the SRB aft IEA on the aft external tank attach 
rings. 


Тһе APUs and their fuel systems are isolated 
from each other. Each fuel supply module 
(tank) contains 22 pounds of hydrazine. The 
fuel tank is pressurized with gaseous nitrogen 
at 400 psi, which provides the force to expel 
(positive expulsion) the fuel from the tank to the 
fuel distribution line, maintaining a positive 
fuel supply to the APU throughout its 
operation. 


The fuel isolation. valve is opened at APU 
startup to allow fuel to flow to the APU fuel 
pump and control valves and then to the gas 
generator. The gas generator's catalytic action 
decomposes the fuel and creates a hot gas. It 
feeds the hot gas exhaust product to the APU 
two-stage gas turbine. Fuel flows primarily 
through the startup bypass line until the APU 
speed is such that the fuel pump outlet pressure 
is greater than the bypass line's. Then all the 
fuel 15 supplied to the fuel pump. 


The APU turbine assembly provides mechanical 
power to the APU gearbox. The gearbox drives 
the APU fuel pump, hydraulic pump, and lube 
oil pump. The APU lube oil pump lubricates 
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the gearbox. The turbine exhaust of each APU 
flows over the exterior of the gas generator, 
cooling it, and is then directed overboard 
through an exhaust duct. 


When the APU speed reaches 100 percent, the 
APU primary control valve closes, and the APU 
speed is controlled by the APU controller 
electronics. If the primary control valve logic 
fails to the open state, the secondary control 
valve assumes control of the APU at 113- 
percent speed. 


Each HPU on an SRB is connected to both servo 
actuators on that SRB. One HPU serves as the 
primary hydraulic source for the servo actuator, 
and the other HPU serves as the secondary 
hydraulics for the servo actuator. Each servo 
actuator has a switching valve that allows the 
secondary hydraulics to power the actuator if 
the primary hydraulic pressure drops below 
2,050 psi. A switch contact on the switching 
valve will close when the valve is in the 
secondary position. When the valve is closed, a 
signal is sent to the APU controller that inhibits 
the 100-percent APU speed control logic and 
enables the 113-percent APU speed control 
logic. The 113-percent APU speed enables one 
APU/HPU to supply sufficient operating 
hydraulic pressure to both servo actuators of 
that SRB. 


The APU 100-percent speed corresponds to 
72,000 rpm and 113-percent to 81,000 rpm. 


The APUs/HPUs and hydraulic systems are 
reusable for 20 missions. 


Thrust Vector Control 


Each SRB has two hydraulic gimbal servo 
actuators: one for rock and one for tilt. The 
servo actuators provide the force and control to 
gimbal the nozzle for thrust vector control. 


The space shuttle ascent thrust vector control 
(ATVC) portion of the flight control system 
directs the thrust of the three SSMEs and the 
two SRB nozzles to control attitude and 
trajectory during liftoff and ascent. Commands 
from the guidance system are transmitted to the 
ATVC drivers, which transmit signals 
proportional to the commands to each servo 
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actuator of the main engines and SRBs. Four 
independent flight control system channels and 
four ATVC channels control six main engine 
and four SRB ATVC drivers, with each driver 
controlling one hydraulic port on each main 
and SRB servo actuator. 


Each SRB servo actuator consists of four 
independent, two-stage servo valves that 
receive signals from the drivers. Each servo 
valve controls one power spool in each actuator, 
which positions an actuator ram and the nozzle 
to control the direction of thrust. 


The four servo valves in each actuator provide a 
force-summed majority voting arrangement to 
position the power spool. With four identical 
commands to the four servo valves, the actuator 
force-sum action prevents a single erroneous 
command from affecting power ram motion. If 
the erroneous command persists for more than 
a predetermined time, the differential pressure 
activates causes an isolation valve to remove 
hydraulic pressure from the defective servo 
valve. This permits the remaining channels and 
servo valves to control the actuator ram spool 
unhindered. Failure monitors are provided for 
each channel to indicate which channel has been 
bypassed. 


Each actuator ram is equipped with transducers 
for position feedback to the thrust vector control 
system. Within each servo actuator ram is a 
splashdown load relief assembly to cushion the 
nozzle at water splashdown апа prevent 
damage to the nozzle flexible bearing. 


SRB Rate Gyro Assemblies 


Each SRB contains two rate gyro assemblies 
(SRGAs), with each SRGA containing one pitch 
and one yaw gyro. These provide an output, 
that is proportional to angular rates about the 
pitch and yaw axes, to the orbiter computers 
and guidance, navigation, and control system 
during first-stage ascent flight in conjunction 
with the orbiter roll rate gyros until SRB 
separation. At SRB separation, a switchover is 
made from the SRGAs to the orbiter RGAs. 


The SRGA rates pass through the orbiter flight 
aft multiplexers/demultiplexers to the orbiter 
GPCs. The SRGA rates then pass through an 


1.4-6 


interchangeable midvalue selection (IMVS) 
scheme to provide SRB pitch and yaw rates to 
the user software. The SRGAs are designed for 
20 missions. 


SRB Separation 


SRB separation is initiated when the head-end 
chamber pressure of both SRBs is less than or 
equal to 50 psi. To protect against chamber 
pressure sensor biases, SRB separation will also 
occur once a certain time has elapsed from 
booster ignition. 


When the separation sequence is initiated, the 
ATVC commands the actuators to the null 
position and puts the SSMEs into a second-stage 
configuration. This ensures the thrust of each 
SRB is less than 100,000 pounds. Orbiter yaw 
attitude is held for 4 seconds, and SRB thrust 
drops to less than 60,000 pounds. 


The SRBs separate from the external tank within 
30 milliseconds of the ordnance firing 
command. 


The forward attachment point consists of a ball 
(SRB) and socket (ET) held together by one bolt. 
The bolt contains one NSI pressure cartridge at 
each end. The forward attachment point also 
carries the range safety system cross-strap 
wiring connecting each SRB and the ET range 


Linear- System 
shaped charge tunnel cover 
assembly (removable) 
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safety systems with each other. 


The aft attachment points consist of three 
separate struts: upper, diagonal and lower. 
Each strut contains one bolt with one NSI 
pressure cartridge at each end. The upper strut 
also carries the umbilical interface between its 
SRB and the external tank and on to the orbiter. 


There are four booster separation motors 
(BSMs) on each end of each SRB. The BSMs 
separate the SRBs from the external tank. The 
solid rocket motors in each cluster of four are 
ignited by firing redundant confined detonating 
fuse (CDF) pyrogen initiators from redundant 
CDF manifolds. 


The separation commands issued from the 
orbiter by the SRB separation sequence initiate 
the redundant NSI detonator pressure cartridge 
in each bolt and ignite the BSMs to effect a clean 
separation. 


Range Safety System 


The shuttle has two range safety systems (RSSs). 
One is located in each SRB. Any one or both are 
capable of receiving two command messages 
(arm and fire) transmitted from the ground 
station. The RSS is used only if the shuttle 
vehicle violates a launch trajectory red line. 


Right SRB Left SRB 
Range safety 
command System tunnel 
Range safety 
command 
antennas 
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An RSS consists of two antenna couplers, 
command receivers / decoders, a dual 
distributor, an S&A device with two NSI 
detonators, four CDF assemblies, and one 
linear-shaped charge (LSC). 


The antenna couplers provide the proper 
impedance for radio frequency and ground 
support equipment commands. The command 
receivers are tuned to RSS command 
frequencies and provide the input signal to the 
distributors when an RSS command is sent. The 
command decoders use a code plug to prevent 
any command signal other than the proper 
command signal from getting into the 
distributors. The distributors contain the logic 
to supply valid destruct commands to the RSS 
pyrotechnics. 


The NSI detonators provide the spark to ignite 
the CDF, which in turn ignites the LSC for 
shuttle vehicle destruction. The S&A device 
provides mechanical isolation between the NSI 
detonators and the CDF before launch and 
during the SRB separation sequence. 


The first message, called arm, allows the 
onboard logic to enable a destruct and 
illuminates a light on the flight deck display 
and control panel at the commander and pilot 
station. The second message transmitted is the 
fire command. 


The SRB distributors in the SRBs are cross- 
strapped together. Thus, if one SRB received an 
arm or destruct signal, the signal would also be 
sent to the other SRB. 


Electrical power from the RSS battery in each 
SRB is routed to RSS system A. The recovery 
battery in each SRB is used to power RSS 
system B as well as the recovery system in the 
SRB. The SRB RSS is powered down during the 
separation sequence, and the SRB recovery 
system is powered up. 
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SRB Descent and Recovery 


The recovery sequence begins with the 
operation of the high-altitude baroswitch, 
which triggers the functioning of the 
pyrotechnic nose cap thrusters. This ejects the 
nose cap, which deploys the pilot chute. This 
occurs at 
15,700 feet altitude, 188 seconds after 
separation. The 11.5-foot-diameter conical 
ribbon pilot chute provides the force to pull the 
lanyard activating the zero-second cutter, which 
cuts the loop securing the drogue retention 
straps. This allows the pilot chute to pull the 
drogue pack from the SRB, causing the drogue 
suspension lines to deploy from their stored 
position. At full extension of the twelve 95-foot 
suspension lines, the drogue deployment bag is 
stripped away from the canopy, and the 54-foot- 
diameter conical ribbon drogue chute inflates to 
its initial reefed condition. The drogue disreefs 
twice after specified time delays, and it 
reorients/stabilizes the SRB for main parachute 
deployment. The drogue chute can withstand a 
load of 270000 pounds and weighs 
approximately 1,200 pounds. 


After the drogue chute has stabilized the vehicle 
in a tail first attitude, the frustum is separated 
from the forward skirt by a charge triggered via 
the low-altitude baroswitch at an altitude of 
5,500 feet, 243 seconds after separation. It is 
then pulled away from the SRB by the drogue 
chute. The main parachute suspension lines are 
pulled out from deployment bags that remain in 
the frustum. At full extension of the lines, 
which are 204 feet long, the three main 
parachutes are pulled from the deployment 
bags and inflate to their first reefed condition. 
The frustum and drogue chute continue on a 
separate trajectory to splashdown. After 
specified time delays, the main parachute 
reefing lines are cut, and the parachutes inflate 
to their second reefed апа full open 
configurations. Тһе main parachute cluster 
decelerates the SRB to terminal conditions. 
Each of the 136-foot-diameter, 20? conical 
ribbon parachutes can withstand a load of 
180,000 pounds and weighs 2,180 pounds. The 
nozzle extension is severed by pyrotechnic 
charge at 20 seconds after low baroswitch 
operation. 
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Water impact occurs 277 seconds after 
separation at a velocity of 76 feet per second. 
The water impact range is approximately 
140 miles off the eastern coast of Florida. 
Because the parachutes provide for a nozzle 
first impact, air is trapped in the empty (burned 
out) motor casing, causing the booster to float 
with the forward end approximately 30 feet out 
of the water. 
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The main parachutes are released from the SRB 
following splashdown using the salt water 
activated release (GWAR) system. The drogue 
with frustum and the depleted SRB are buoyant. 
The main parachutes remain tethered to the SRB 
until the retrieval ships arrive for recovery 
operations. Various parameters of SRB 
operation are monitored and displayed on the 
orbiter flight deck control and display panel 
and are transmitted to ground telemetry. 
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Recovery - Separation Through Drogue Disreef 
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Recovery - Main Deploy Through Main Disconnect 
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This section discusses in detail each of 25 
orbiter systems as listed here in the Table of 
Contents. The subsections are organized 
alphabetically, with a detailed internal table of 
contents provided for each. 


Each system subsection begins with descriptive 
information covering general purpose, function, 
and location. Relevant elements of each system 
are then provided in some detail. Where orbiter 
panels or DPS displays apply, an illustration of 
such appears as near the reference as possible. 
In the case of large panels, appropriate 
fragments are placed in the text, with full panel 
diagrams provided in Appendix A. 


Most system subsections conclude with a 
summary. Caution and warning summaries 
and rules of thumb are also provided where 
appropriate. 
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Auxiliary Power Unit 


Description 


The orbiter has three independent hydraulic 
systems. Each consists of a main hydraulic 
pump, hydraulic reservoir, hydraulic bootstrap 
accumulator, hydraulic filters, control valves, 
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hydraulic/Freon heat exchanger, electrical 
circulation pump, and electrical heaters. 


Each system provides hydraulic pressure to 
position hydraulic actuators for: 


1. Thrust vector control (ТУС) of the 
main engines by gimbaling the three 
SSMEs 


2. Actuation of various control valves on 
the SSMEs 


3. Movement of the orbiter aerosurfaces 
(elevons, body flap, rudder/speed 
brake) 


4. Retraction of the external tank/ orbiter 
17-inch liquid oxygen апа liquid 
hydrogen disconnect umbilicals with- 
in the orbiter at external tank jettison 


5. Маіп/поѕе landing gear deployment 
(system 1) / (system 1 ог 2) 


6. Main landing gear brakes and anti-skid 


7. Nose wheel steering (system 1 with 
backup from system 2) 


Each hydraulic system is capable of operation 
when exposed to forces or conditions caused by 
acceleration, deceleration, normal gravity, zero 
gravity, hard vacuum, and temperatures 
encountered during on-orbit dormant conditions. 


Three identical, but independent, improved 
auxiliary power units (APUs; also called ІАРОѕ) 
provide power for the orbiter hydraulic systems. 
The APU is a hydrazine-fueled, turbine-driven 
power unit that generates mechanical shaft 
power to drive a hydraulic pump that produces 
pressure for the orbiter’s hydraulic system. Each 
unit weighs about 88 pounds and produces 135 
horsepower. 


Each APU consists of a fuel tank, a fuel feed 
system, a system controller, an exhaust duct, lube 
oil cooling system, and fuel/lube oil vents and 
drains. Redundant electrical heater systems and 
insulation thermally control the system above 45° 
F to prevent fuel from freezing and to maintain 
required lubricating oil viscosity. Insulation is 
used on components containing hydrazine, lube 
oil, or water to minimize electrical heater power 
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requirements and to keep high surface 
temperatures within safe limits on the turbine 
and exhaust ducts. 


The three APUs and fuel systems are located in 
the aft fuselage. Each APU fuel system supplies 
storable liquid hydrazine fuel to its respective 
fuel pump, gas generator valve module, and 
gas generator, which decomposes the fuel 
through catalytic action. The resultant hot gas 
drives a single-stage, dual pass turbine. The 
turbine exhaust flow returns over the exterior of 
the gas generator, cooling it, and is then 
directed overboard through an exhaust duct at 
the upper portion of the aft fuselage near the 
vertical stabilizer. 


The turbine assembly provides mechanical 
power through a shaft to drive reduction gears 
in the gearbox. The gearbox drives a fuel 
pump, a hydraulic pump, and a lube oil pump. 
The hydraulic pump supplies pressure to the 
hydraulic system. The fuel pump increases the 
fuel pressure at its outlet to sustain pressurized 
fuel to the gas generator valve module and gas 
generator. The lube oil system supplies 
lubricant to the gearbox reduction gears and 
uses the reduction gears as scavenger pumps to 
supply lube oil to the inlet of the lube oil pump 
to increase the pressure of the lube oil system. 


The lube oil of each APU is circulated through a 
heat exchanger in a corresponding water spray 
boiler. Three water spray boilers (WSBs), one 
for each APU, cool the lube oil systems. The 
hydraulic fluid of each hydraulic pump driven 
by an APU is also circulated through a 
hydraulic heat exchanger in the corresponding 
water spray boiler to cool hydraulic fluid 
during hydraulic system operation. The three 
WSBs are also located in the aft fuselage of the 
orbiter. 


Fuel System 


The APU fuel system (one for each of the three 
APUs) includes the fuel tank and fuel isolation 
valves, the fuel pump, and fuel control valves. 
The improved APUs use passive heat sinks and 
heat shields to minimize the effects of heat 
soakback. 
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Fuel Tanks 


The APU fuel tanks are mounted on supports 
cantilevered from the sides of the internal 
portion of the aft fuselage. The fuel is storable 
liquid anhydrous hydrazine. The hydrazine is 
stored in a fuel tank with a total capacity of 
about 350 pounds. The fuel tank, which 
incorporates a diaphragm at its center, is 
serviced with fuel оп one side апа the 
pressurant (gaseous nitrogen) on the other. The 
nitrogen is the force acting on the diaphragm 
(positive expulsion) to expel the fuel from the 
tank to the fuel distribution lines and maintain 
a positive fuel supply to the APU throughout its 
operation. Each typical prelaunch fuel tank 
load is approximately 332 pounds. The fuel 
supply supports the nominal power unit 
operating time of 90 minutes in a mission or 
any defined abort mode, such as an abort once 
around, when the APUs run continuously for 
approximately 110 minutes. Under operating 
load conditions, an APU consumes approxi- 
mately 3 to 3.5 pounds of fuel per minute. 
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Auxiliary Power Unit Locations 


The fuel tanks are 28-inch-diameter spheres. 
Fuel tanks 1 and 2 are located on the port side 
of the orbiter's aft fuselage, and tank 3 is located 
on the starboard side. Each fuel tank is serviced 
through its respective fill and drain service 
connections, located on the corresponding side 
of the aft fuselage. The gaseous nitrogen 
servicing connection for each fuel tank is 
located on the same panel as the fuel servicing 
connections on the corresponding side of the aft 
fuselage. The fuel tank is pressurized to 365 psi 
prelaunch. 


21-2 
2.1 Auxiliary Power Unit/Hydraulics (APU/HYD) 


Each fuel tank’s temperature and gaseous 
nitrogen pressure are monitored by the APU 
controller and transmitted to the GPC, where 
quantity is calculated and transmitted to the 
APU FUEL/H20 QTY meters on the dedicated 
MEDS display. The fuel quantity of 100 percent 
on the meter is equivalent to 350 pounds. Fuel 
pressure (psia) is shown on the FUEL PRESS 
meter on the dedicated MEDS display. Fuel 
quantity in percent is also displayed on the BFS 
SM SYS SUMM 2 display (FUEL QTY). 


The gaseous nitrogen pressure in each fuel tank 
exerts a force on the tank’s diaphragm to expel 
the hydrazine fuel under pressure to the fuel 
distribution system. Filters are incorporated 
into each distribution line to remove any 
particles. The fuel distribution line branches 
into two parallel paths downstream of the filter. 
An isolation valve is installed in each parallel 
path, providing redundant paths to permit fuel 
flow to the APU or to isolate the APU from the 
fuel supply tanks. 
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APU FUEL TK VLV Switches and Circuit Breakers on Panel R2 


Fuel Tank Isolation Valves 


Both isolation valves in each АРО fuel 
distribution system are electrically powered 
solenoid valves that are controlled by the 
corresponding APU FUEL TK VLV 1, 2, 3 
switches on panel R2. They are energized open 
when the corresponding switch is positioned to 
OPEN; both valves are closed when the switch 
is positioned to CLOSE, or if electrical power 
is lost. 


Each valve has a reverse relief function to 
relieve pressure on fuel trapped in the fuel 
distribution line downstream of the fuel tank 
valves when both valves are closed. The valve 
relieves the downstream pressure when the 
pressure increases 40 psi to 200 psi above fuel 
tank pressure due to heat soakback following 
APU shutdown. 


The ТАРП fuel tank isolation valves are cooled 
by fuel flow when the valves are open. Each 
valve has redundant temperature 
measurements (two per valve, four per APU). 
One temperature reading for each valve is 
displayed on the ВЕ5 SM SYS SUMM 2 display 
and the APU/HYD, DISP 86 display (Ops 201) 
beside the FU TK УГУ AT and BT labels. There 
are two tank isolation valve circuit breakers per 
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ADU (one per valve) located on panel R2. These 
can be pulled to disconnect electrical power 
from the solenoid if a valve fails open or shorts. 
The valve heating profile, when the fuel is 
stagnant, is gradual and, in the event of a failed 
open valve or short, permits adequate time for 
corrective action. 


Fuel Pump 


Each APU fuel pump is a fixed-displacement, 
gear-type pump that discharges fuel at 
approximately 1,400 to 1,500 psi and operates at 
approximately 3,918 rpm. A fuel filter is located 
at the fuel pump outlet, and a relief valve 
relieves at approximately 1,725 psi back to the 
pump inlet if the filter becomes clogged. 


Each fuel pump is driven by the turbine through 
the reduction gearbox. The fuel pump reduction 
gear is located in the lube oil system gearbox, and 
a shaft from the reduction gear drives the fuel 
pump. Seals are installed on the shaft to contain 
any fuel or lube oil leakage. If leakage occurs 
through the seals, it is directed to a drain line that 
runs to a 500-cubic centimeter catch bottle for 
each APU. Ё the catch bottle is overfilled, it will 
relieve overboard at approximately 45 psia 
through a burst disk and drain port. After the 
disk bursts, the pressure relief valve will cycle 
at approximately 28 psia. On ascent or entry, 
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the flight crew сап monitor the catch bottle’s 
line pressure on the BFS SM SYS SUMM 2 
display (PMP LK P). 
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Fuel Control Valves 


The APU’s operating speed is controlled by the 
primary and secondary fuel control valves, 
which are installed in series downstream of the 
fuel pump. These are solenoid-operated pulser- 
type valves. In the normal APU operating 
mode, the primary control valve pulses to 
maintain the APU’s speed at about 74,000 rpm 
(103%), while the secondary control valve 
attempts to control at 113% rpm. If the APU is 
taken to high via the APU SPEED SELECT 
switch on panel R2, the primary valve attempts 
to control at 115% rpm, while the secondary 
valve begins pulsing, and controls APU speed 
at about 81,000 rpm (113%). If the secondary 
valve subsequently fails open, the primary 
valve will maintain APU speed at about 83,000 
rpm (115%). Ш the secondary valve loses 
power, it goes to the closed position and shuts 
down the APU. As noted above, the primary 
valve goes to full open if it loses power, 
allowing the secondary valve to take over 
automatically and control at high speed (113%). 


The crew can see APU speed on the BFS SM SYS 
SUMM 2 display (APU SPEED %) in percent 
(100 percent = 72,000 rpm). Тһе speed 
fluctuates due to the nature of the pulse- 
modulated fuel flow system. 
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For safety reasons, each APU has an automatic 
shutdown feature that will shut the APU down 
if the speed falls below 80 percent (57,600 rpm) 
or rises above 129 percent (92,880 rpm). 


Gas Generator and Turbine 


Each gas generator consists of a bed of Shell 405 
catalyst in a pressure chamber, mounted inside 
the APU exhaust chamber. When the hydrazine 
fuel comes into contact with the catalyst, it 
undergoes an exothermic reaction, 
decomposing into a hot gas at approximately 
1,700° F. The gas expands rapidly and makes 
two passes through a single-stage turbine 
wheel, passes over the outside gas generator 
chamber, and exits overboard through its own 
independent exhaust duct, located near the base 
of the vertical stabilizer. The temperature of the 
hot gas at the exhaust duct is approximately 
1,000° F. 


The shaft power from the spinning turbine is 
sent to the hydraulic main pump associated 
with the APU via a speed reduction gearbox. It 
is also used to drive the APU’s fuel pump and 
lubrication oil pump. 


The normal speeds of the hydraulic main pump, 
APU fuel pump, and APU lube oil pump are 
3,918 rpm, 3,918 rpm, and 12,215 rpm, 
respectively. The lube oil system is necessary to 
lubricate the APU gearbox and the fuel pump. 


The temperatures of the gas generator bed, the 
gas generator fuel injector, and the turbine 
exhaust gas are visible on the BFS SM SYS 
SUMM 2 DPS display (GG BED, INJ, TEMP 
EGT). While the APU is running, the gas gener- 
ator bed temperature transducer goes off-scale 
high at about 510° F. On orbit, when the APU is 
shut down, the gas generator bed temperature 
transducer is useful to monitor the bed temper- 
ature when the bed is kept warm by heaters. 


Lubricating Oil 


The APU lube oil system is a scavenger-type 
with a fixed-displacement pump. Each APU 
turbine, through its gearbox, drives a lube oil 
pump at 12,215 rpm. The system is pressurized 
with gaseous nitrogen (СМ) to provide 
adequate suction pressure to start the lube oil 
pump under zero-gravity conditions. Each lube 
oil system has its own nitrogen gas storage 
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vessel that is pressurized to approximately 140 
psia. The pressurization system for each lube 
oil system has a valve controlled by its 
corresponding APU controller. The ОМ: 
pressurization valve for each power unit is 
energized open by its corresponding controller 
when the gearbox pressure is below 5.2 psi, + 
1.3 psi, to ensure that gearbox pressure is 
sufficiently above the requirements for proper 
scavenging and lube pump operation. 


The pump increases the lube oil pressure to 
approximately 60 psi, directs the lube oil 
through the corresponding water spray boiler 
for cooling, and returns the lube oil to the 
accumulators and gearbox. Two accumulators 
in each lube oil system allow thermal expansion 
of the lube oil, accommodate gas initially 
trapped in the external lube circuit, maintain 
lube oil pressure at a minimum of approxi- 
mately 15 psia, and act as a zero-gravity, all- 
altitude lube reservoir. 


The following information is transmitted to the 
BFS SM SYS SUMM 2 display by the APU 
controller via the GPC: lube oil pump outlet 
pressure (OIL OUT P) at approximately 45 psia, 
outlet temperature at approximately 270° F, and 
a return temperature from the water spray 
boiler (OIL IN, OUT) at approximately 250° F 
for each APU. The lube oil temperature of each 
APU is also monitored on the APU OIL TEMP 
meter on the dedicated MEDS display. 
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Electronic Controller 


Each APU has its own digital controller. The 
controller detects malfunctions, controls turbine 
speed, gearbox pressurization, and fuel 
pump/ gas generator heaters. Each controller is 
controlled by its corresponding APU CNTLR 
PWR switch on panel R2. When the switch is 
positioned to ON, 28-volt dc power is sent to 
that controller and APU. The controllers are 
redundantly powered via dual internal remote 
power controllers. When the switch is posi- 
tioned to OFF, electrical power is removed from 
that controller and APU. 


APU Start 


An APU/HYD READY TO START talkback 
indicator for each APU is located on panel R2. 
Тһе talkback signals gray when that APU 
hydraulic system is ready to start; that is, when 
the APU gas generator temperature is above 
190? F, APU turbine speed is less than 80 
percent, WSB controller is ready, а 
corresponding APU fuel tank isolation valve is 
open, and corresponding hydraulic main pump 
is depressurized. When the APU is started, and 
its turbine speed is greater than 80 percent of 
normal speed, the corresponding indicator 
shows barberpole. 
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А barberpole APU/HYD READY ТО 
START talkback will not inhibit a start. 


APU OPERATE 1, 2, 3 switches are located on 
panel R2. When the switches are positioned to 
START/RUN, the corresponding APU controller 
activates the start of that unit and removes 
electrical power automatically from the unit's 
gas generator and fuel pump heaters. 


To start the APU, fuel expelled from the 
hydrazine tank flows through the open tank 
valves and filter to the gas generator valve 
module, which contains the primary and 
secondary fuel control valves in series. The 
primary pulse control valve is normally open, 
and the secondary pulse control valve is 
energized open. Fuel flowing through the 
pump bypass valve is directed to the gas 
generator, because the fuel pump is not being 
driven at that moment by the APU turbine. 


The fuel in the gas generator decomposes 
through catalytic reaction, creates hot gas, and 
directs the hot gas to the single-stage turbine, 
which begins to rotate. The turbine's 
mechanical shaft drives the reduction gears, 
rotating the fuel pump, lube oil pump, and 
hydraulic pump. The fuel pump increases the 
fuel pressure at its outlet and provides 
pressurized fuel to the gas generator valve 
module and gas generator. 


The startup logic delays the APU underspeed 
logic check for 10.5 seconds after the start 
command is issued. This allows the APU to 
reach normal operating speed before the 
shutdown logic begins checking for a speed 
lower than 80 percent. The auto shutdown 
capability of the controller can be disabled by 
taking the АРИ AUTO SHUT DOWN switch on 
panel R2 to INHIBIT. 


Тһе startup logic does not delay the APU 
overspeed logic. If an overspeed is detected at 
any time by the controller, the F7 and MASTER 
ALARM will annunciate. If the AUTO SHUT 
DOWN on panel R2 is ENABLED, the controller 
will automatically close the tank isolation 
valves and close the secondary control valve. 
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CAUTION 


After an APU auto shutdown, the APU 
FUEL TK VLV switch must be taken to 
CLOSE prior to having an auto shutdown. 


Failure to close a FUEL TK VLV after an APU 
Shutdown can result in the fuel tank isolation 
valves reopening and allowing flow fuel to 
an APU gas generator bed that is above the 
temperature limits for safe restart. 


APU Speed Control 


When the APU turbine speed exceeds the 
control target (103 percent for NORMAL and 
113 percent for HIGH) the appropriate control 
valve closes. The fuel is then diverted through 
a bypass line back to the fuel pump inlet. When 
the turbine speed drops below the control 
target, the appropriate valve opens directing 
fuel to the gas generator and closing off the 
bypass line. The primary fuel valve pulses to 
maintain APU speed. The frequency and 
duration of the primary fuel control valve pulses 
are functions of the hydraulic load on the unit. 


The secondary fuel control valve normally stays 
fully open during the operation of the primary. 
If the primary valve loses power, it goes to the 
fully open position, and the secondary valve 
begins pulsing and controlling APU speed. If 
the secondary valve loses power at any time it 
closes and the APU is shut down. If the auxiliary 
power unit is taken to a high speed (by the APU 
SPEED SELECT switch on panel R2), the 
primary valve attempts to control to 115 percent 
rpm, while the secondary valve controls the 
unit’s speed at 113 percent rpm. 


Each APU controller controls the speed of each 
unit upon the activation of the APU SPEED 
SELECT switch for each APU on panel R2. The 
NORM position controls the speed а! 
74,160 rpm, 103 percent, plus or minus 
8 percent. The HIGH position controls the 
speed at 81,360 rpm, 113 percent, plus or minus 
8 percent, with a second backup of 82,800 rpm, 
115 percent, plus or minus 8 percent. 
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APU Auto Shutdown 


The APU AUTO SHUT DOWN switches on 
panel R2 enable the automatic shutdown 
feature in the associated APU controllers. 
When the switch is positioned to ENABLE, each 
controller monitors its corresponding APU 
speed. If that APU speed falls below 57,600 
rpm (80 percent) or rises above 92,880 rpm (129 
percent), the controller automatically shuts 
down that unit. Each shutdown command 
closes that unit’s secondary fuel valve and the 
tank isolation valves. 


Ready 
to Start 


Water Spray Boiler 


Hydraulic main pump 
pressure - normal 


Controller A or B 
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Steam vent temperature 
above 130° F 


СМ, shutoff valve open 


Water APU fuel tank 


Panel R2 


boiler valve - open 


controller 
ready 


Hydraulic bypass valve 
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APU Controller 


Gas generator temperature 
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Turbine speed below 80% APU controller 
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APU Ready-for-Start Talkback Indicator Logic 


When an APU AUTO SHUT DOWN switch is 
positioned to INHIBIT, the automatic shutdown 
sequence for its APU controller is inhibited. If 
the turbine speed falls below 80 percent or rises 
above 129 percent АРИ UNDERSPEED or APU 
OVERSPEED caution and warning lights on 
panel F7 will be illuminated, and a tone will be 
generated, even though the APU AUTO SHUT 
DOWN switch is in INHIBIT. 


CAUTION 
An APU should not be restarted after an 


overspeed shutdown. Uncontained over- 
speed and turbine wheel breakup could 
occur if restart is attempted. 
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Injector Cooling System 


The gas generator injector water cooling system 
is used only when the normal cool-down period 
of approximately 180 minutes is not available. 
The system sprays water to reduce the 
temperature of the gas generator injector branch 
passages to less than 400° F in the event that a 
hot APU must be restarted after it has been 
recently shut down. The water cooling ensures 
that the hydrazine will not detonate in the fuel 
line leading into the injector due to heat 
soakback from the gas generator. The injector is 
cooled by circulating water around it. The 
water from the gas generator injector is 
exhausted into the aft fuselage. 
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A single water tank located in the aft fuselage of 
the orbiter serves all three APUs. The water 
tank is 9.4 inches in diameter and loaded with 
about 9 pounds of water or 21 minutes worth of 
cooling. Тһе water tank is pressurized with 
gaseous nitrogen at a nominal pressure of 120 
psi. The pressure acts on a diaphragm to expel 
the water through three 0.25-inch-diameter lines 
to three control valves. When the APU 
OPERATE switch on panel R2 for APU 1, 2, or 3 
is positioned to INJECTOR COOL, the water 
valve of that unit opens and directs the water 
into the gas generator injector to cool it. 


If the injector branch (internal) temperature of 
an APU is above 400° F from heat soakback, or 
if the catalytic bed heater temperature is above 
430° F, the flight crew must cool the injector for 
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3.5 minutes before starting the APU. Operational 
data from hot APUs shows that the GG INJ 
temperature does not accurately reflect the drop 
in injector branch temperatures. The crew is safe 
to attempt a restart if the GG INJ temperature is 
decreasing and at least 3.5 minutes of continuous 
injector cooling has been completed. A Class 3 
alarm with message "APU 1 (2) Cooldown" will 
annunciate 225 seconds after APU injector 
cooling is initiated. 


CAUTION 


Care must be taken not to delay in the OFF 
position when taking the АРИ OPERATE 
switch to START/RUN. If cooldown is 


terminated more than 1 second prior to 
starting the APU, the injector branch 


temperatures may increase above start 
limits, and detonation may occur without 
another cooldown cycle. 


The water tank supply is sufficient for about six 
total hot starts. The unit's injector temperature 
can be monitored on the BFS SM SYS SUMM 2 
display (INJ). 


Fuel Pump and Gas Generator 
Valve Module Cooling 


The fuel pump and gas generator valve module 
are cooled by passive cooling. The improved 
APUs have passive heat sinks and heat shields to 
absorb conductive and radiant heat. This 
prevents excessive heat soakback in the gas 
generator valve and fuel pump assemblies. 
There are no water tanks or associated plumbing 
for this module with the APUs. The crew has no 
requirement to do anything to provide cooling. 
This passive cooling system, in conjunction with 
active injector cooling, is used to allow for 
contingency restarts in the event a deorbit 
becomes necessary within approximately 180 
minutes of APU shutdown. 


CAUTION 


An APU may not be restarted if the 
temperature of the fuel pump is above 


2109 Е or the temperature of the gas 
generator valve module is above 200? F, 
because hydrazine detonation may occur. 
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APU Heaters 


The APU HEATER TANK/FUEL LINE/H2O 
SYS 1А, IB, 2A, 2B, ЗА, ЭВ switches on panel 
A12 operate the thermostatically controlled 
heaters located on the corresponding APU fuel 
system and water system. The fuel tank, fuel 
line, and water line heaters for each APU аге 
divided into redundant A and B systems. For 
example, for APU 1, the TANK/FUEL LINE/ 
Н20 SYS 1A switch powers the A heaters, and 
the thermostats provide automatic control. 
Only one set of heaters is used at a time. The 1B 
switch powers the 1B heaters, and the 
thermostats provide automatic control. Тһе 
APU fuel tank and line heater thermostats 
maintain the temperatures between a nominal 
55? F and 65? F. The water system heater 
thermostats maintain the temperatures between 
55? F and 65? F. The OFF position of each 
switch removes power from the respective 
heater circuits. 


The APU HEATER GAS GEN/FUEL PUMP 1, 
2, 3 switches on panel A12 power thermostati- 
cally controlled heaters located on the 
corresponding APU, fuel pump, gas generator 
valve module, and gas generator bed heater. 
The thermostats control a series of heaters on 
the gas generator valve module, fuel pump, and 
all the fuel lines and the water lines from the 
fuel pump spray manifold to the gas generator 
valve module. The heaters are divided into 
redundant A and B systems for each APU. The 
A AUTO switch powers the A heater, and the A 
thermostat | automatically | controls | the 


corresponding APU fuel pump heater, 
maintaining fuel pump and gas generator valve 
module temperatures at about 100° F. The gas 
generator bed heater is maintained between 
360° and 425° F by a comparator in the APU 
controller that receives its signal from the bed 
temperature transducer. The gas generator 
temperature range ensures efficient APU 
startup through efficient catalytic reaction. The 
B AUTO switch position provides the same 
capability for the B heater system. The gas 
generator and fuel pump heaters are 
automatically deactivated by the corresponding 
controller at APU start. The OFF position of 
each switch removes power from the respective 
heater circuits. These heater switches also 
provide redundant power to the gas generator 
and gearbox pressure signal conditioners for 
use while the APU controller is off. 


The lube oil system lines on each APU also have 
a heater system. These heaters are controlled by 
the APU HEATER LUBE OIL LINE 1, 2, 3 
switches on panel A12. The lube oil line heaters 
for each APU are also divided into an A and B 
system; e.g., for 1, A AUTO, and B AUTO. The 
A AUTO switch powers the A heater, and the 
thermostat automatically controls the 
corresponding lube oil system heater, 
maintaining the lube oil line in the temperature 
range of 55° F to 65° F. The B AUTO switch 
position provides the same capability to the B 
heater system. The OFF position of each switch 
removes power from the respective heater 
circuits. 
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Water Spray Boilers 


The water spray boiler (WSB) system consists of 
three identical independent water spray boilers, 
one for each APU/hydraulic system. The 
boilers are located in the aft fuselage of the 
orbiter. Each WSB cools the corresponding 
APU lube oil system and hydraulic system by 
spraying water onto their lines; as the water 
boils off, the lube oil and hydraulic fluid are 
cooled. The steam that boils off in each water 
spray boiler exits through its own exhaust duct, 
located on the starboard side of the vertical 
stabilizer. 


Each WSB is 45 by 31 inches long by 19 inches 
wide, and including controller and vent nozzle, 
weighs 181 pounds. They are mounted in the 
orbiter aft fuselage between Х, 1340 and 1400, at 
Zo 488 minus 15, and at Y, plus 15. Insulation 
blankets cover each boiler. The boiler's water 
capacity is 142 pounds. 


The WSBs have had WSB freeze-up problems in 
the past. WSB freeze-up occurs after the preloaded 
boiler water has evaporated, and active cooling has 
not yet begun. During that time, residual water 
in the core, spray bars, or water feedline is exposed 
to low pressures and will begin freezing. To 
alleviate this problem, each WSB stores a water 
and propylene glycol monomethyl ethel (PGME) 
mixture in a bellows-type storage tank. The 
tank is pressurized by gaseous nitrogen, 
providing positive water expulsion to feed the 
boiler. The PGME and water mixture of 47% 
and 53%, respectively, is the solution to the WSB 
freeze-up problem. The PGME/water mixture has 
been flown, preloaded in the boiler since 
STS-102, and has been flown in the boilers and the 


Hydraullc fluid 
bypass valve 
Gaseous nitrogen vent 


Water boller vent 


Water boller drain 


Gaseous nitrogen fill 


Hydraullc fluld In 


Hydraullc fluld out 


Water Spray Boller 
(one of three) 


USA007587 
Rev. A 


WSB tanks since STS-114. Currently, all WSB tanks 
are loaded with the PGME mixture. 


Hydraulic fluid passes through the boiler three 
times. APU lube oil passes through the boiler 
twice. The hydraulic fluid tubes are sprayed 
with water from three water spray bars, and two 
water spray bars spray the APU lube oil. 
Separate water feed valves allow independent 
control of the hydraulic fluid spray bars and 
APU lube oil spray bars. Redundant electrical 
controllers provide completely automatic 
operation. 


The boiler system maintains APU lube oil 
temperature at approximately 250° F and the 
hydraulic fluid in the range of 210° to 220° F. 


The crew can see the WSB water quantity (Н20 
QTY), nitrogen tank pressure (N2 P), nitrogen 
regulator pressure (REG P), and nitrogen tank 
temperature (N2 T) on the right side of the SM 
APU/HYD (DISP 86) display on orbit. 
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The gaseous nitrogen pressure for each WSB is 
contained in a corresponding 6-inch spherical 
pressure vessel. The pressure vessel contains 
0.77 pound of nitrogen at a nominal pressure of 
2,400 psi at 70° F. The gaseous nitrogen storage 
system of each WSB is directed to its corre- 
sponding water storage tank. Each storage 
vessel contains sufficient nitrogen gas to expel 
all the water from the tank and allow for relief 
valve venting during ascent. 


The nitrogen shutoff valve between the pressure 
valve and water storage tank of each boiler 
permits the pressure to reach the nitrogen 
regulator and water tank or isolates the nitrogen 
supply from the water tank. Each nitrogen 
valve is controlled by its respective BOILER N2 
SUPPLY 1, 2, or 3 switch on panel R2. The 
nitrogen shutoff valve, which is latched open or 
closed, consists of two independent solenoid 
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primary or secondary controller. 


A single-stage regulator is installed between the 
nitrogen pressure shutoff valve and the water 
storage tank. The gaseous nitrogen regulator 
for each water spray boiler regulates the high- 
pressure nitrogen between 24.5 and 26 psig as it 
flows to the water storage tank. 


A relief valve is incorporated inside each 
nitrogen regulator to prevent the water storage 
tank pressure from exceeding 33 psig. The 
gaseous nitrogen relief valve opens between 30 to 
33 psig. 


Water Supply System 


The water supply for each boiler is stored in a 
positive-displacement aluminum tank contain- 
ing a welded metal bellows separating the 
stored water inside the bellows from the 
nitrogen expulsion gas. 
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BOILER Switches on Panel К2 


Redundant pressure and temperature sensors 
located downstream from the gaseous nitrogen 
pressure vessel and on the water tank for each 
boiler transmit the pressures and temperatures 
through each controller to the systems manage- 
ment general-purpose computer. The computer 
computes the water tank quantity from the 
pressure, volume, and temperature, апа 
transmits the water tank quantity to the 
dedicated MEDS display for each boiler. Water 
quantity is available when either the A or B 
controller is powered. 


Downstream of the water storage tank, the 
feedwater lines to each water boiler split into 
two parallel lines: one line goes to the hydraulic 


fluid flow section and one to the lube oil section 
of the WSB. The H2O spray valves in each 
feedline are controlled independently by the 
boiler controller. 


Temperature Control 


The two boiler controllers are operated by 
the respective BOILER CNTLR/HTR 1, 2, 
and 3 switches on panel R2. When the 
applicable switch is positioned to A, the A 
controller for that boiler is powered; if it is 
positioned to B, the B controller is powered. 
The OFF position removes electrical power from 
both controllers. 
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MEDS APU/HYDRAULIC Display 


The BOILER PWR 1, 2, and 3 switches on panel 
R2 enable (provide the automatic control 
functions) the specific controller A or B selected 
for that boiler by the BOILER CNTLR/HTR 1, 2, 
and 3 switches on panel R2. When the applica- 
ble controller A or B is enabled for that boiler, a 
ready signal is transmitted to the corresponding 
APU/HYD READY TO START indicator on 
panel R2 if the following additional conditions 
are met: gaseous nitrogen shutoff valve is open, 
steam vent nozzle temperature is greater than 
130? F, and hydraulic fluid bypass valve is in 
the correct position with regard to the hydraulic 
fluid temperature. 


The core of each WSB is a stainless steel 
crimped-tube bundle. The hydraulic fluid sec- 
tion is divided into three 17-inch-long passes of 
smooth tubes (first pass-234 tubes, second pass- 
224 tubes, and third pass-214 tubes). The lube 
oil section of the APU comprises two passes 
with 103 crimped tubes in its first pass and 81 
smooth tubes in the second pass. The tubes are 
0.0125 of an inch in diameter with a wall 
thickness of 0.010 of an inch. Crimps located 
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every 0.24 of an inch break up the internal 
boundary layer and promote enhanced turbu- 
lent heat transfer. Although the second pass is 
primarily a low-pressure drop return section, 
approximately 15 percent of the unit's lube oil 
heat transfer occurs there. Three connected 
spray bars feed the hydraulic fluid section, 
while two spray bars feed the power unit's lube 
oil section in each boiler. 


When the orbiter is in the vertical position on 
the launch pad, each boiler is loaded with up to 
4.86 pounds of PGME/water mixture, which is 
referred to as "pool mode" operation. When 
each APU/ hydraulic system and WSB are in 
operation 5 minutes before lift-off, the APU 
lube oil tube bundle is immersed in the boiler 
water precharge. As the vehicle ascends during 
launch, the lube oil system of the APU heats up, 
eventually the boiler water precharge boils off, 
and the boiler goes into the spray mode about 
13 minutes after launch. The hydraulic fluid 
usually does not heat up enough during ascent 
to require spray cooling. 
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When the APU/hydraulic combination 18 
started for atmospheric entry, the hydraulic 
fluid and power unit lube oil flow commences, 
fluid temperatures rise, and spraying is initiated 
as required. During the lower part of entry, 
when the boiler temperature reaches 188° F, the 
water spray boiler returns to the pool mode. 
The spray bars begin discharging excess water 
to fill the boiler. When the water reaches the 
liquid level sensors, the spray is turned off so 
that the boiler is not overfilled. During entry, 
because the orbiter's orientation is different 
from that of launch, the boiler can hold up to 14 
pounds of water. 


The enabled controller of the operating WSB 
monitors the hydraulic fluid and lube oil outlet 
temperature from the APU. The hydraulic fluid 
outlet temperature controls the hydraulic fluid 
H20 spray control valve, and the lube oil outlet 
temperature controls the lube oil water spray 
control valve. Signals are based on a compari- 
son of the hydraulic system fluid temperature to 
its 208° F set point and of the lube oil of the 
power unit to its 250° F set point. When the 
respective water feed valve opens, instantane- 
ous flows of 10 pounds per minute maximum 
through the hydraulic section and 5 pounds per 
minute maximum through the lube oil section 
enter the water boiler through the correspond- 
ing spray bars to begin evaporative cooling of 
the hydraulic fluid and APU lube oil. The 
steam is vented out through the overboard 
steam vent. 


The separate water feed valves modulate the 
water flow to each section of the tube bundle 
core in each WSB independently in 200-millisec- 
ond pulses that vary from one pulse every 10 
seconds to one pulse every 0.25 of a second. 


Because of the unique hydraulic system fluid 
flows, control valves are located in the hydraulic 
system fluid line section of each WSB. Normally, 
hydraulic system fluid flows at up to 21 gallons 
per minute; however, the hydraulic system 
experiences 1- to 2-second flow spikes at up to 63 
gallons per minute. If these spikes were to pass 
through the boiler, pressure drop would increase 
ninefold and the boiler would limit the flow of 
the hydraulic system. To prevent this, a relief 
function is provided by a spring- loaded poppet 
valve that opens when the hydraulic fluid 
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pressure drop exceeds 49 psi and is capable of 
flowing 43 gallons per minute at a differential 
pressure of 50 psi across the boiler. А 
temperature controller bypass valve allows the 
hydraulic fluid to bypass the boiler when the 
fluid temperature decreases to 190° F. At 210° F, 
the controller commands the bypass valve to 
direct the fluid through the boiler. When the 
hydraulic fluid cools to 190° F, the controller 
again commands the valve to route the fluid 
around the boiler. Bypass valve (BYP УГУ) 
status is available on the following displays: SM 
SYS SUMM 2 (PASS AND BFS) and PASS DISP 
86 APU/HYD. 


Heaters 


Each water boiler, water tank, and steam vent is 
equipped with electrical heaters to prevent 
freeze-up in orbit. The water tank and boiler 
electrical heaters are activated by the corre- 
sponding BOILER CNILR/HTR 1, 2, and 3 
switches on panel R2. The A or B position of 
each switch selects the A or B heater system and 
is automatically controlled by the corresponding 
A or B controller. The steam vent heaters are also 
activated by the BOILER CNTLR/HTR 1, 2 and 3 
switches but only if the BOILER PWR 1, 2 or 3 
switch on panel R2 is ON. The water tank and 
boiler heaters are cycled on at 50? F and off at 
55° Е. The steam vent heaters are not operated 
continuously in orbit; they аге activated 
approximately two hours before APU startup. 
The steam vent heaters are cycled on at 150? F 
and cycled off at 175? F. 


Main Hydraulic Pump 


Тһе main hydraulic pump for each hydraulic 
system is a variable displacement type. Each 
operates at approximately 3,900 rpm when 
driven by the corresponding APU. 


Each main hydraulic pump has an electrically 
operated depressurization valve. The depres- 
surization valve for each pump is controlled by 
its corresponding HYD MAIN PUMP PRESS 1, 2, 
or 3 switch on panel R2. When the switch is 
positioned to LOW, the depressurization valve is 
energized to reduce the main hydraulic pump 
discharge pressure from its nominal range of 
2,900 to 3,100 psi output to a nominal range of 
500 to 1,000 psi to reduce the APU torque 
requirements during the start of the APU. "APU 
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Press Low" is one of the inputs required to get a 
gray READY TO START talkback. 


NOTE 


An APU cannot be successfully started 
with HYD MAIN PUMP PRESS posi- 
tioned to NORM. 


After an APU has been started, the 
corresponding HYD MAIN PUMP PRESS 
switch is positioned from LOW to NORM. This 
de-energizes the respective depressurization 
valve, allowing that hydraulic pump to increase 
its outlet pressure from 500 to 1,000 psi to 
2,900 to 3,100 psi. Each hydraulic pump is a 
variable displacement type that provides 0 to 63 
gallons per minute at 3,000 psi nominal with the 
APU at normal speed and up to 69.6 gallons per 
minute at 3,000 psi nominal with the APU at 
high speed. 
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Main pump outlet pressure (HYD PRESS) can 
be seen by the crew on the BFS SM SYS SUMM 
2 or PASS DISP 86 APU/HYD displays. A 
high-pressure relief valve in the filter module 
for each hydraulic system also relieves the 
hydraulic pump supply line pressure into the 
return line in the event the supply line pressure 
exceeds 3,850 psid. 


A separate pressure sensor (sensor A) in the 
filler module for each hydraulic system 
monitors the hydraulic system source pressure 
and displays the pressure on the HYDRAULIC 
PRESSURE 1, 2, and 3 meters on the dedicated 
MEDS display. This hydraulic pressure sensor 
also provides an input to the yellow HYD 
PRESS caution and warning light on panel F7 if 
the hydraulic pressure of system 1, 2, or 3 is 
below 2,400 psi. 
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Hydraulic Reservoir 


Hydraulic reservoir pressure is maintained 
using an accumulator bootstrap mechanism. 
The bootstrap uses a variable area piston 
assembly to convert high pressure in the 
accumulator to lower pressure in the reservoir 
(roughly 40:1). This reservoir pressure 
maintains adequate hydraulic inlet pressure at 
both the main pump and circulation pump to 
prevent cavitation during startup and opera- 
tion. When the main hydraulic pump is in 
operation, the high-pressure side of the piston 
and the bootstrap accumulator are pressurized 
to 3,000 psig from the main pump discharge 
line. When the main hydraulic pump is shut 
down, the priority valve closes, and the 
bootstrap accumulator maintains a pressure of 
approximately 2,500 psi. The 2,500 psi on the 
high side results in a main pump inlet (low 
side) pressure of approximately 62 psia. The 
minimum inlet pressure to assure a reliable 
main pump start is 20 psia (which corresponds 
to a high-pressure side of 800 psi). This pre- 
vents the main pump from cavitating (not 
drawing hydraulic fluid), which could damage 
the pump. 


The quantity in each reservoir is 8 gallons. The 
hydraulic fluid specification is MIL-H-83282, 
which is a synthetic hydrocarbon (to reduce fire 
hazards). The reservoir provides for volumetric 
expansion and contraction. Тһе quantity of 
each reservoir is monitored in percent on the 
HYDRAULIC QUANTIIY meters on the 
dedicated MEDS display. A pressure relief 
valve in each reservoir protects the reservoir 
from overpressurization and relieves at 120 
psid. 


Hydraulic Accumulator 


The accumulator is a bellows type, precharged 
with gaseous nitrogen to 1700 psig at 70? F. The 
gaseous nitrogen capacity of each accumulator 
is 115 cubic inches, and the hydraulic volume is 
51 cubic inches. 
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Circulation Pump and Heat Exchanger 


Тһе circulation pump is actually two fixed- 
displacement gear-type pumps in tandem, 
driven by a single motor. One is a high pres- 
sure, low-volume pump (2,500 psig), which is 
used to maintain accumulator pressure while 
the hydraulic system is inactive in orbit. The 
other is a low pressure, high-volume pump (350 
psig), which is used to circulate hydraulic fluid 
through the orbiter hydraulic lines while the 
hydraulic system is inactive in orbit in order to 
warm up cold spots. The hydraulic fluid is 
circulated through a Freon/hydraulic fluid heat 
exchanger to pick up heat from the orbiter Freon 
coolant loops. A temperature-controlled bypass 
valve directs the hydraulic fluid through the 
heat exchanger if the temperature at the heat 
exchanger inlet is less than 105? F. The bypass 
valve bypasses the fluid around the heat 
exchanger if the temperature is greater than 115? F. 


An unloader valve at the circulation pump 
outlet directs the high pressure output from the 
circulation pump into the accumulator until the 
accumulator pressure is greater than 2,563 psia, 
then redirects the high pressure output to 
combine with the low pressure output to the 
hydraulic lines. 
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HYD CIRC PUMP Switches on Panel R2 


Each circulation pump can be manually turned 
on or off with the corresponding HYD CIRC 
PUMP switch on panel R2. If the switch is 
placed in GPC, the pump will be activated and 
deactivated by the SM GPC according to a 
control software program based on certain 
hydraulic line temperatures and/or accumula- 
tor pressure. This program activates the 
appropriate circulation pump when any of the 
control temperatures drop below either 0° F, or - 
10° F, depending on their locations, and 
deactivates the circulation pump when all of the 
control temperatures for that system are greater 
than 20° F, or after 15 minutes for system 1 and 
10 minutes for systems 2 and 3. The 
activation/ deactivation limits for these control 
temperatures can be changed during the flight 
by crew or Mission Control. 


The program also includes a timer to limit the 
maximum time a circulation pump will run, and 
a priority system to assure that only one 
circulation pump is on at a time. Only one 
circulation pump is turned on at a time because of the 
circulation pump’s excessive power use. Each 
circulation pump uses 2.4 kW of electrical power. 
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This software will also automatically provide for 
the repressurization of the hydraulic accumulator 
when the pressure lowers to a value of 1,960 psi. 
In this contingency, the circulation pump will 
first receive the highest priority to operate and 
will be turned ON while other circulation pumps 
are operating in thermal mode (this means that 
two pumps can be operating simultaneously). 
After the pump has been repressurized, the 
accumulator above 1,960 psi, or a period of 2 
minutes (this value can be changed by Mission 
Control Center uplink) has elapsed, the 
circulation pump will be commanded to OFF. 


The circulation pump is automatically 
disconnected when its corresponding APU Run | 
command is issued by the APU controller. Each 
circulation pump can be powered by one of two 
orbiter main electrical buses, selectable by the 
HYD CIRC PUMP POWER switches on panel 
А12. 


The crew сап see circulation pump outlet 
pressure as well as the hydraulic line and 
component temperatures on the PASS SM HYD 
THERMAL display, DISP 87. 
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SM HYD THERMAL Display (DISP 87) 


The SM APU/HYD display (DISP 86) shows the 
hydraulic system pressure, reservoir tempera- 
ture, reservoir quantity (in percent), and 
hydraulic accumulator pressure. 


Hydraulic Heaters 


Areas of the hydraulic lines that cannot be 
warmed by fluid circulation while the system is 
inactive on-orbit are warmed by heaters. These 
heaters are automatically controlled by thermo- 
stats to maintain the hydraulic line tempera- 
tures in a specified range. Each heated area has 
redundant heaters (A and B), which are con- 
trolled by the HYDRAULIC HEATER switches 
on panel A12. 


Operations 


The WSB controllers are powered up at launch 
minus 8 hours, and the boiler water tanks are 
pressurized in preparation for APU activation. 
The controllers activate heaters on the water 
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tank, boiler, and steam vent to assure that the 
water spray boiler is ready to operate for launch. 


APU start is delayed as long as possible to save 
fuel. At T minus 6 minutes 15 seconds, the pilot 
begins the prestart sequence. The pilot confirms 
that the WSB is activated, then activates the 
APU controllers and depressurizes the main 
hydraulic pump. Depressurizing the main 
pump reduces the starting torque on the APU. 
The pilot then opens the fuel tank valves and 
looks for three APU ready-to-start indications 
(gray talkbacks). At T minus 5 minutes, the 
pilot starts the three units by setting the APU 
OPERATE switches to START/RUN and checks 
the hydraulic pressure gauges for an indication 
of approximately 800 psi. Then the pilot 
pressurizes the main pump and looks for 
approximately 3,000 psi on the gauges. All three 
hydraulic main pump pressures must be greater 
than 2,800 psi by T minus 4 minutes 5 seconds or 
the ground launch sequencer (GLS) will initiate an 
auto launch hold. 


The APUs operate during the ascent phase and 
continue to operate through the first OMS burn. 
At the conclusion of the main engine purge, 
dump, and stow sequence, the APUs and WSBs 
are shut down. The same sequence applies for a 
delayed OMS-1 burn. If an abort once around is 
declared, the APUs are left running, but the 
hydraulic pumps are depressurized to reduce 
fuel consumption. The units are left running to 
avoid having to restart hot APUs for deorbit 
and reentry. 


Six hours after lift-off, or as soon as they are 
required, depending on the environment, the 
gas generator/fuel pump heaters are activated 
and are in operation for the remainder of the 
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orbital mission. The fuel and water line heaters 
are activated immediately after APU/HYD 
SHUTDN in the post OMS-1 timeframe to prevent 
the lines from freezing as the APUs cool down. 


Two hours after lift-off, during the Post Insertion 
Checklist, the steam vent heaters of the WSBs are 
turned on for about 1.5 hours to bake out ice 
from the steam vents. The hydraulic thermal 
conditioning is enabled by taking the hydraulic 
circulation pumps to GPC. Further, the HYD 
CIRC PUMP POWER switch(es) on panel A12 
will be configured to distribute electrical loads 
when appropriate. 


While the vehicle is in orbit, the hydraulic 
circulation pumps are in the GPC шоае- 
automatically activated when hydraulic line 
temperatures become too low and automatically 
deactivated when the lines warm up 
sufficiently. 


On the day before deorbit, one APU is started to 
supply hydraulic pressure for flight control 
system checkout. (Hydraulic pressure 15 
needed to move the orbiter aerosurfaces as part 
of this checkout.) The associated WSB 
controller is activated, landing gear and brake 
isolation valves are confirmed closed, and one 
APU (selected by the Mission Control Center) is 
started. The hydraulic main pump is set to 
normal pressure (approximately 3,000 psi), and 
aerosurface drive checks are made. After about 
5 minutes, the checks are complete, and the 
APU is shut down. Normally, the unit does not 
run long enough to require WSB operation. 


During deorbit prep (D/O minus 3.5 hours), the 
APU/HYD systems are configured. The boilers' 
steam vent heaters are activated to prepare the 
system for operation during atmospheric entry, 
and the circulation pumps are turned off. At 
deorbit minus 2 hours, the brake heaters are 
activated and the final switch configuration will 
turn OFF the hydraulic heaters on panel A12. 
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At 45 minutes before deorbit, the WSB water 
tanks are pressurized, the APU controllers are 
activated, and the main hydraulic pumps are set 
to low pressure. The pilot opens the fuel tank 
valves and looks for three gray APU/HYD 
READY TO START talkbacks. The pilot then 
closes the fuel tank valves. This procedure 
takes place while the crew is in contact with the 
ground so that flight controllers can observe 
APU status. Five minutes before the deorbit 
burn, one APU (selected by Mission Control) is 
started to ensure that at least one unit will be 
operating for entry. The hydraulic pump is left 
in low-pressure operation. The APU operates 
through the deorbit burn. At 13 minutes before 
entry interface (400,000-foot altitude), while the 
orbiter is still in free fall, the other two APUs 
are started, and all three hydraulic pumps are 
pressurized to normal. Two main engine 
hydraulic isolation valves are cycled open and 
then closed to ensure that the engines are 
stowed for entry. If required, the aerosurfaces 
are put through an automatic cycle sequence to 
make sure warm hydraulic fluid is available in 
the aerosurface drive units. 


After touchdown, a hydraulic load test may be 
done to test the response of the auxiliary power 
units and hydraulic pumps under high load 
(i.e, high flow demand) conditions. This test 
cycles the orbiter aerosurfaces with one 
hydraulic system at a time in depressed mode 
(the remaining two APUs and hydraulic pumps 
have to drive all the aerosurfaces). This is 
typically done on the first flight of a new APU. 
Then the main engine hydraulic isolation valves 
are opened again, and the engines are set to the 
transport position. At this point, the hydraulic 
systems are no longer needed; the APUs and 
WSBs are shut down. 
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APU/HYD Caution and Warning 
Summary 


The yellow APU TEMP caution and warning 
light on panel F7 is illuminated if the APU 1, 
2, or 3 lube oil temperature is above 290° Е. 


The yellow APU OVERSPEED light is 
illuminated if APU 1, 2, or 3 turbine speed is 
more than 92,880 rpm (129%). If the APU 
AUTO SHUT DOWN switch on panel R2 is in 
ENABLE, an automatic shutdown of that 
APU will occur. 


The yellow APU UNDERSPEED light is 
illuminated if APU 1, 2, or 3 turbine speed is 
less than 57,600 rpm (80%). If the APU AUTO 
SHUT DOWN switch for that APU is in 
ENABLE, an automatic shutdown will occur. 
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Placing the APU AUTO SHUT DOWN switch 
in INHIBIT only inhibits the automatic 
shutdown of that APU if its turbine speed is 
less than 80% or more than 129%. The APU 
UNDERSPEED or APU OVERSPEED light 
will always illuminate, and a tone will be 
generated. 


The yellow HYD PRESS light illuminates 
when hydraulic system 1, 2, or 3 drops below 
2,400 psi for any reason. 


The blue SM ALERT illuminates, and the 
C/W tone is sounded if turbine speed falls 
below 80% or rises above 129%. 


The red BACKUP C/W ALARM illuminates if 
hydraulic pressure of system 1, 2, or 3 drops 
below 2,400 psi. 
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APU/HYD Summary Data 


The APU is a hydrazine-fueled, turbine-driven 
power unit that generates mechanical shaft 
power to drive a hydraulic pump that 
produces pressure for the orbiter's hydraulic 
system. 


The three orbiter hydraulic systems provide 
pressure to position hydraulic actuators for: 
gimbaling SSMEs, actuating SSME control 
valves, moving orbiter aerosurfaces, retract- 
ing ET disconnect umbilicals, deploying 
landing gear, and providing brake power, 
anti-skid, and nose wheel steering. 


The APUs are located in the aft fuselage of 
the orbiter. 


Each APU/HYD system has an independent 
water spray boiler for APU lube oil and 
hydraulic fluid cooling. Water is used after 
APU shutdown for injector cooling if a hot 
restart is required. The APUs share a central 
supply tank for injector cooling. 


The three APUs are started 5 minutes before 
lift-off. They continue to operate throughout 
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the launch phase, and are shut down after 
the main engine propellant dump and stow 
are completed (post OMS-1). The APUs are 
restarted for entry: one APU prior to the 
deorbit burn, and the other two prior to entry 
interface. 


Each APU fuel tank load is approximately 
325 pounds of hydrazine. 


APU/HYD controls are located on panel R2; 
heater controls are on panel A12. 


Displays containing APU/HYD information 
include the PASS and BFS SM SYS SUMM 2 
display (DISP 79), APU/HYD display (DISP 
86), HYD THERMAL (DISP 87), and 
APU/ENVIRON THERM (DISP 88). 


APU/HYD parameters can be monitored on 
the APU/HYD MEDS Display if selected. 


APUs can be manually shut down and 
restarted after completion of a full injector 
water cooling cycle (3.5 minutes), or after 
approximately 180 minutes of passive 
cooling on orbit. 


APU/HYD Rules of Thumb 


e APU fuel usage rates vary with loading, but 


average 1% per minute (З to 3.5 Ib/minute). 
Usage rates are reduced by about half if the 
hydraulic main pump is taken to low pres- 
sure (HYD MAIN PUMP PRESS switch on 
panel R2 set to LOW), as is done during the 
abort once around deorbit coast period. 


The APU injector cooling tank shared by all 
three APUs contains enough water for 21 
minutes of continuous flow. This is enough 
for six complete 3.5-minute hot restart 
injector cooling cycles. 


If all water spray boiler cooling is lost to the 
lube oil after an APU reaches full operating 
temperatures, only 2 to 3 minutes of operat- 
ing time are available before bearing seizure 
Occurs. 
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EVAP TEMP 
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HI LOAD 75 79 H20 LN INJ +71 92 +72 
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Description 


The Caution and Warning System warns the 
crew of conditions that may create a hazard 
to orbiter operation and/or crew. Under certain 
circumstances, the system also alerts the crew 
to situations that require time-critical (under 5 
minutes) procedures to correct them. The 
system uses data such as temperature, pressure, 
flow rates, and switch positions to determine 
whether there is ап alarm situation. 
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The system consists of software and electronics 
that provide the crew with visual and aural 
cues when а system exceeds predefined 
operating limits. Visual cues consist of four red 
MASTER ALARM lights, a 40-light array on 
panel F7, a 120-light array on panel R13U, GPC 
annunciated fault messages, and a blue SM 
ALERT light. The aural cue is sent to the 
communications system for distribution to 
flight crew headsets or speaker boxes. 


The crew interfaces with the C/W system 
through panel R13U, panel C3, DPS displays, 
panel F7, panel L1, and the four red MASTER 
ALARM pushbutton indicators on panels F2, 
F4, A7, and МО52). 


The C/W system interfaces with the auxiliary 
power units, data processing system, environ- 
mental control and life support system, 
electrical power system, flight control system, 
guidance and navigation, hydraulics, main 
propulsion system, reaction control system, 
orbital maneuvering system, and payloads. 


Inputs enter the software C/W logic circuitry 
from the onboard computers through multi- 
plexers/demultiplexers (MDMs) to activate 
alarm tones and the BACKUP C/W ALARM. 
Some of these are used to turn on the BACKUP 
C/W ALARM light on panel F7 while crew 
input resets the MASTER ALARM lights and tones. 
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Alarms 


Four alarm classes constitute the C/W system. 


Class 1 - Emergency 


There are two alarms in this class: (1) smoke 
detection/fire suppression and (2) rapid cabin 
depressurization. (These systems аге 
discussed in more detail later in this section.) 
Class 1 is a hardware system only; its input is 
not processed by any MDMs or software. The 
system uses hardware, such as hard-wired 
sensors, to monitor parameters and to issue 
alarms. Because of the nature of the class 1 
alarms, they always receive the highest 
priority for resolution. 


The emergency (class 1) aural alarms consist 
of a siren (activated by the smoke detection 
system) and a klaxon (activated by the delta 
pressure/delta time sensor that recognizes a 
rapid loss of cabin pressure), and they are 


annunciated by hardware. The siren tone is 
similar to emergency sirens on American 
police cars or other civilian emergency 
vehicles. The klaxon is a short repeating tone 
that is unique and readily distinguished from 
other C/W tones. 


The emergency alarm visual cues consist of 
illumination of the four MASTER ALARM 
pushbutton indicators on panels F2, F4, A7, 
and MO52J. The smoke detection system also 
illuminates SMOKE DETECTION lights on 
panel L1 and displays information on the SM 
SYS SUMM 1 display (SMOKE). Similarly, 
cabin pressure information can be seen on the 
SM SYS SUMM 1 display (CABIN). 


Class 2 - C/W 


This class also consists of two subclasses: 
primary C/W, which is a hardware system, 
and backup (B/U) C/W, which is a software 
system. 
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The primary C/W system has the capacity to 
monitor 120 inputs, which are received from 
transducers through either signal conditioners 
or flight forward MDMs. Baselined limit values 
are stored in the C/W electronics unit located in 
avionics bay 3. These values can be changed by 
the crew through switches on panel R13U. 
However, if power is lost and subsequently 
recovered, the limits will return to their original 
values. The majority of the original stored 
values are identical to the backup C/W 
(software) values. Thirty-nine lights on the 
panel F7 annunciator matrix are dedicated to 
the primary С/УУ, the exception is the BACKUP 
C/W ALARM. 


When a primary C/W alarm is issued, the 
appropriate lamp on the panel F7 annunciator 
matrix is illuminated, all four MASTER 
ALARM indicators are illuminated, and the 
C/W tone sounds. No GPC fault message is 
generated by the primary C/W. 


The C/W system receives power from two 
sources. This power is supplied to the C/W 
electronics unit by power supplies that are 
internal to the electronics unit and are referred 
to as power supply A and power supply B. 
Power supply A receives power from the C/W 
A circuit breaker powered by ESS 1BC on panel 
013, and power supply B from C/W B circuit 
breaker powered by ESS 2CA on panel 013. 


A loss of power supply A will cause all panel F7 
lights, except BACKUP C/W ALARM, to 
illuminate. It will also cause a loss of panel 
R13U status lights and function, smoke 
annunciation via tone generator А, the 
CAUTION/WARNING | MEMORY READ 
switch, lower bulbs of the MASTER ALARM 
light (except for lamp test), primary C/W limit 
sensing, and tones to the middeck. 


A loss of power supply B causes the BACKUP 
C/W ALARM light to come on in addition to 
the primary C/W light, a loss of smoke 
annunciation via tone generator B, upper bulbs 
of the MASTER ALARM lights (except during a 
lamp test), and sleep station headset tones. 


The backup C/W (class 2) system is part of the 
systems management fault detection and 
annunciation (FDA), GNC, and backup flight 
system software programs. Only the C/W 
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alarms that are produced by FDA (software that 
monitors parameters and initiates alarms) have 
limits that can be changed and displayed in 
engineering units accessed through the SM 
TABLE MAINTENANCE special function 
display (SPEC 60). The remaining backup C/W 
alarms that are produced by the guidance and 
navigation program are accessed through 
general-purpose computer read/ write 
procedures. А backup C/W out-of-tolerance 
condition will trigger illumination of the four 
MASTER ALARM lights, illuminate the red 
BACKUP C/W ALARM light on panel F7, and 
display a message on the fault message line and 
fault summary page. 


FUELCELL | FUELCELL | FUELCELL 
02 PRESS HERES REAC Р ЗТАСК ТЕМР РОМР 
R 
O HEATER MAIN BUS AC AC 
CABIN ATM 2 
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(R) ТЕМР UNDERVOLT OVERLOAD 
FREON AV ВАҮ/ 
rp CABIN AIR IMU FWD RCS RCSJET 
Н20 LOOP | RGA/ACCEL AIR DATA LEFT RCS RIGHT RCS 
tR} (R)- 
гээ LEFT RHC RIGHT/AFT LEFT OMS RIGHT OMS 
(в) RHC (R) 
PAYLOAD rcs (R) 
WARNING, GPC SATURATION Өмөк ши 
PAYLOAD FCS 
CAUTION PRIMARY C/W | CHANNEL ши) 
BACKUP СМ/ АРУ APU APU 
HYD PRESS 
ALARM (ву TEMP OVERSPEED | UNDERSPEED 
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Caution and Warning Annunciator Matrix 
on Panel F7 
The 39 lights shown are dedicated to the primary C/W System. The 
BACKUP C/W ALARM light is dedicated to the entire backup C/W 
system. (R) signifies a red warning light. 


C/W Circuit Breaker on Panel 013 
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The class 2 (C/W) aural master alarm is 
activated by the primary (hardware) system, the 
backup (software) system, or both. The 
alternating C/W alarm tone is generated when 
the hardware system detects an out-of-limit 
condition on any of the 120 parameters it 
monitors or when the software (backup) system 
detects a parameter that is out of limits. 


Class 2 primary and backup C/W visual cues 
include a 40-light annunciator matrix on panel 
F7. This matrix annunciates various system or 
functional failures. Each light is driven by one 
or more parameters. With the exception of the 
BACKUP C/W ALARM light, once a lamp has 
been illuminated, it will not be extinguished 
until all parameters driving that light are back 
within limits or inhibited. THE BACKUP C/W 


ALARM light is extinguished once a М5С RESET 
key is pushed. 


Panel R13U is the crew's interface with the 
primary C/W system. It includes a parameter 
status light matrix that is used to check the 
status of a parameter and also to check 
parameter limits. When used to check the 
status of parameters, the numbers on the left 
side of the matrix are read first to obtain the 
first two numbers of the parameter (row), then 
the number on the top is read to obtain the third 
number of the parameter. The matrix can 
display all 120 parameters (numbered from 000 
to 119) of the primary C/W system. 


C/W PARAMETER C/W PARAMETER C/W PARAMETER C/W PARAMETER Cw PARAMETER 
CH NAME CH NAME CH NAME CH NAME CH NAME 
0 CRYO O2 Р TK1 25 СРС 3 50 CRYO H2 P TK1 *75 00 L RHC 
1 СБҮОО2НТВ1ТК1 26 RCS LEAK/TK P - F 51 CRYOO2HTR2TK3 76 RCS TK P FU- R 101 FCS SATURATION 
2 FC1 REAC O2 27 OMS ENG-L 52 FC3 REAC H2 *77 102 ЕС2 COOL PUMP 
3 DC VOLT MAINA 28 APU 3 EGT 53 AC3 VOLT (фА, В,С) 78 APU 2 OVERSPEED 03 IMU 
4 CAB PRESS 29 MPS HE TKP-R 54 CAB N2 FLOW 1 79 MPS MANF P LH2 104 AV BAY 3 TEMP 
5 GPC 1 30 CRYO O2PTK4/5  *55 80 CRYOH2PTK4/5 105 Н20 LOOP 1 PUMP OUT Р 
6 RCS TK P OX - F 31 CRYOO2HTR2TK2 56 RCS LEAK/TKP-L 581 CRYO 02 НТБ1 TKS 106 FREON LOOP 1 FREON FLOW 
7 OMS TK P OX-L 32 FC2 REAC H2 57 OMS ЕМС -R 82 FC3 STACK Т 107 FREON LOOP 1 EVAP OUT T 
8 APU 1 ЕСТ 33 АСІ1УО1Т(фА, В,С) 58 APU 3 OIL T 83 AC3 OVLD 08 APU 2 UNDERSPEED 
9 MPS HE TKP -C 34 CAB PPO2 A 59 MS HE REG P-R 84 AV BAY 1 TEMP 09 HYD2P 
10 CRYO O2 P TK2 35 СРС 4 60 СВҮО Н2Р ТК2 #85 110 R/AFT RHC 
11 СБҮОО2НТВ21К1 36 RCS TK P OX-L 61  CRYOO2HTR1TK4 86 RCSLEAK/TKP-R 111 FCS CH BYPASS 
12 ЕСІ ВЕАС H2 87 OMS TK P OX-R 62 FC1 STACK T *87 12 РСЗ COOL PUMP 
13 DC VOLT MAIN B 38 APU 1 OIL T 63 АС1 OVLD 88 APU З OVERSPEED “113 
14 CAB О2 FLOW 1 39 MPS HE ВЕСР - С 64 САВ М2 FLOW 2 *89 14 CAB HX OUT T 
15 GPC 2 *40 CRYO O2 P ТКБ *65 *90 115 Н20 LOOP 2 PUMP ООТР 
16 RCS TK P FU - Е 41 CRYOO2HTR1TK3 66 RCS TK P OX-R 91 ADTA 116 FREON LOOP 2 FREON FLOW 
17 OMS TK P FU-L 42 FC3 REAC O2 67 OMS TVC 92 FC1 COOL PUMP 127 FREON LOOP 2 ЕУАР OUT T 
18 APU 2 EGT 43 AC2VOLT (А, В, С) 68  APUIOVERSPEED 93 ВСА/АА 118 APU 3 UNDERSPEED 
19 MPS HE TKP-L 44 CAB PPO2B 69 MPS MANF PL O2 94 AV BAY 2 TEMP 119 HYD 3P 
20 CRYO O2 P TK34 45 GPC 5 70 CRYO H2 P TK3 95 PL WARNING 
21 CRYOO2HTR1TK2 46 RCS TK P FU -L 71 CRYOO2HTR2TK4 96 RCS JET * Not used 
22 FC2 REAC 02 47 OMS TK P FU- R 72 FC2 STACK T 97 PL CAUTION 
23 DC VOLT MAIN C 48 APU 2 OIL T 73 АС2 OVLD 98 APU 1UNDERSPEED 
24 CAB О2 FLOW 2 49 MPS HE REG P-L 74 CAB FAN AP 99 HYD1P 
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Parameter Status Light Matrix on Panel R13U 


Class 3 - Alert 


This class is a software system operated by the 
SM software. It would generally receive lower 
priority than a class 1 or 2 alarm. Class З alert is 
designed to inform the flight crew of a situation 
leading up to a class 2 alarm or one that may 
require a long procedure (over 5 minutes) in 
order to rectify the problem. When an alert 
parameter exceeds its limits, the blue SM 
ALERT light on panel F7 is illuminated, a 
discrete is sent to the primary C/W system to 
turn on the alert tone, and the software displays 
a fault message on the fault message line and 
fault summary page. 


Both guidance, navigation, and control (GNC) 
and systems management (SM) software sense 
out-of-limit conditions. These software systems 
also serve some less critical parameters and 
annunciate the SM alert tone. This tone is a 
steady tone of predefined duration generated in 
the C/W electronics when activated by inputs 
from the onboard computers. 


Class 0 - Limit Sensing 


Class 0 is a software system consisting of up 
and down arrows on the DPS displays next to a 
parameter. It provides no aural annunciation. 
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A down arrow displayed next to a parameter 
would indicate that the low limit for that 
parameter had been met or violated. In addi- 
tion, the down arrow is used to indicate a state 
that does not agree with the nominal state; for 
example, a fan that is nominally on (e.g., HUM 
SEP fan) is off. 


An up arrow displayed next to a parameter 
would indicate that the upper limit for that 
parameter has been exceeded. 


Smoke Detection and Fire Suppression 


This emergency class 1 alarm is hardware 
driven. The crew is alerted to emergency 
situations by use of visual and audio alarms. 


Smoke detection and fire suppression capabili- 
ties are provided in the crew cabin avionics 
bays and in the crew cabin. Smoke detectors, 
which sense levels of smoke concentrations and 
rate of concentration change, trigger alarms and 
provide information on smoke concentration 
levels to the performance-monitoring DPS 
system and an array of red SMOKE 
DETECTION lights on panel L1. 


The smoke detector system is divided into two 
groups: group A and group B. Group A smoke 
detectors are located in the environmental 
control and life support system 
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cabin fan plenum outlet beneath the crew cabin 
middeck floor and in the left return air duct on 
the crew cabin flight deck, and one element is 
located in each of the three forward avionics 
bays (1, 2, and 3A). Group B smoke detectors are 
located in the right return air duct on the crew 
cabin flight deck and in avionics bays 1, 2, and 
ЗА. 


Smoke detectors 


jm bay 3A 
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detectors Portable fire 


“extinguisher 
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Smoke Detection and Fire Suppression 
System 


If a smoke detector senses a smoke particle 
concentration of 2,000 (£200) micrograms per 
cubic meter for at least 5 seconds and/or a rate 
of smoke increase of 22 micrograms per cubic 
meter per second for eight consecutive counts in 
20 seconds, a trip signal illuminates the 
applicable red SMOKE DETECTION light on 
panel L1, illuminates the four red MASTER 
ALARM lights on panels F2, F4, A7, and 
MO52J, and sounds the siren in the crew cabin. 
The normal reading on the SM SYS SUMM 1 
display for the smoke detectors is 0.3 to 0.4 
milligram per cubic meter. A reading on the 
display of 2.0, plus or minus 0.2, corresponds to 
2,000 (+200) micrograms per cubic meter. 


After an alarm and a reset of the detector, the 
following conditions may be observed: 


e If the alarm returns in 5 seconds, it is 
due to the concentration exceeding 2,000 
+ 200 micrograms per cubic meter for 5 
seconds. 
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e If the alarm returns in 20 seconds, it is 
due to the concentration increasing at a 
rate greater than or equal to 22 
micrograms per cubic meter per second 
for eight consecutive counts in 20 
seconds. 


e If the alarm returns immediately, the 
detector would be suspect, and a self 
test should be performed. If available, 
the concentration readout should be 
observed оп SM SYS SUMM 1. 


e If the alarm does not return, perform 
self test. If available, check 
concentration on SM SYS SUMM 1. 
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SM SYS SUMM 1 (DISP 78) 


Fire suppression in the crew cabin avionics bays 
is provided by three Halon extinguisher bottles 
permanently mounted in avionics bays 1, 2, and 
3A. Each bottle contains 3.74 to 3.8 pounds of 
Halon in a pressure vessel that is 8 inches long 
and 4.25 inches in diameter. To activate the 
applicable bottle in an avionics bay, the 
corresponding FIRE SUPPRESSION switch on 
panel L1 is positioned to ARM, and the 
corresponding AGENT  DISCH  pushbutton 
indicator on panel L1 is depressed for at least 2 
seconds. Тһе AGENT DISCH pushbutton 
indicator activates the corresponding pyro 
initiator controller, which initiates a pyrotechnic 
valve on the bottle to discharge the Halon into 
the avionics bay. The discharge of Halon will 
produce a noise of approximately 130 decibels 
in the avionics bay. 
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Panel L1 


The discharge will give a Halon concentration 
in the avionics bay of 7.5 to 9.5 percent. А 4105 
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percent concentration is required to suppress a 
fire. This concentration will provide protection 
for approximately 72 hours. When the AV bay 
fire bottles are discharged, the pushbutton 
indicators will illuminate when the pressure in 
the bottle falls below 60 + 10 psig. This 
indicates that the bottle is fully discharged. 


Red SMOKE DETECTION lights on panel L1 are 
illuminated by the following: the CABIN light 
is illuminated by a smoke detector in the ECLSS 
cabin fan plenum, the L FLT DECK light is 
illuminated by the crew cabin left flight deck 
return air duct smoke detector, the R FLT DECK 
light is illuminated by the crew cabin right 
flight deck return air duct smoke detector. The 
PAYLOAD light is illuminated by the smoke 
detectors in pressurized payload modules; і.е., 
Spacehab. Note that although the payload 
smoke detection light on L1 will illuminate, the 
smoke concentration data field on Sys Summ 1 
will not display data for the payload smoke 
detector. The SPEC display for the payload will 
contain that data. The applicable smoke detector 
illuminates the applicable red AV BAY light on 
panel L1, activates the CW MASTER ALARM 
red light, and sounds the siren in the crew 
cabin. 
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Fire Extinguisher Locations 
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Fire and Smoke Subsystem Control Circuit 
Breakers on Panel 014 
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Fire and Smoke Subsystem Control Circuit 
Breakers on Panel 015 
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Fire and Smoke Subsystem Control Circuit 
Breakers on Panel 016 


The circuit breakers that control the fire and 
smoke subsystem are located on panels 014, 
015, and 016. Panel 014 contains the MN A 
SMOKE DETN L/R FLT DK and BAY 2A/3B, 
FIRE SUPPR BAY 3, and ANNUN FWD ACA 1 
circuit breakers. Panel 015 contains MN B 
SMOKE ПЕТМ BAY 1B/3A, FIRE SUPPR BAY 1 
and annunciator FWD ACA 1 and ACA 2/3 and 
AFT ACA 4/ circuit breakers. Panel 016 
contains MN C SMOKE DETN CABIN and BAY 
1A/2B, FIRE SUPPR BAY 2, and 
ANNUNCIATOR FWD ACA 2/3 and AFT ACA 
4/5. 
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Three hand-held fire extinguishers are available 
in the crew cabin. Two are located in the crew 
cabin middeck, and one is on the flight deck. 
Each fire extinguisher nozzle is tapered to fit 
fire hole ports located in several display and 
control panels. The holes are of two types: а %- 
inch diameter hole covered with a marked label, 
and an unmarked % to -inch diameter 
tapered hole. These holes give access to the 
volume immediately behind the individual 
panel. To suppress a fire behind a panel or 
within an avionics bay, the extinguisher nozzle 
should be inserted into the fire hole and the 
actuating mechanism depressed for 15 seconds. 


This will ensure a complete discharge. The 
extinguishing agent is Halon-1301 
(monobromotrifluoromethane). Halon-1301 


minimizes the major hazards of a fire: smoke, 
heat, oxygen depletion, and formation of 
combustion products such as carbon monoxide. 
The fire extinguishers are 13 inches long. The 
portable fire extinguishers can also be used as a 
backup for extinguishers in the avionics bays. 
Consideration should be given to the propulsive 
force on the crewmember when discharging the 
extinguishers on orbit. 
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Halon 1301 


Halon 1301 is used as the extinguishing agent 
for all fire suppression devices. It is colorless 
and odorless. Discharge of the agent may create 
a light mist in the vicinity of the discharge 
nozzle. Therefore, visibility is not adversely 
affected. Once the Halon is discharged into an 
enclosure, it is difficult to detect its presence 
through normal human senses. 


Exposure to Halon in the 5 to 7 percent range 
produces little, if any, noticeable effect. At 
levels between 7 and 10 percent, mild central 
nervous system effects such as dizziness and 


tingling in the extremities have been reported. 
Above 10 percent, some subjects report a feeling 
of impending unconsciousness after a few 
minutes, although test subjects exposed to up to 
14 percent for 5 minutes have not actually lost 
consciousness. These types of effects were 
completely reversible upon removal from 
exposure. 


It is considered good practice to avoid all 
unnecessary exposure to Halon 1301 and to 
limit exposures to the following times: 

• 7 percent and below: 15 minutes 

е 7 to 10 percent: 1 minute 


Avionics 
Вау по. 1 


Avionics 
Bay no. 2 


Avionics bays 1 and 2 ` 6) 


Avionics 
Bay no. 3B 
Avionics 
Вау по. ЗА < 


e 10 to 15 percent: 30 seconds 
е Above 15 percent: prevent exposure 


Anyone suffering from toxic effects of Halon 
1301 should immediately move or be moved to 
fresh air. In treating persons suffering toxic 
effects, the use of epinephrine (adrenaline) and 
similar drugs must be avoided. These drugs 
may produce cardiac arrhythmias, including 
ventricular fibrillation. 


Although Halon 1301 has a low toxicity, its 
decomposition can be hazardous. These prod- 
ucts have a characteristically sharp acrid odor, 
even in minute concentrations of only a few 
parts per million. This smell provides a warn- 
ing system but at the same time creates a 
noxious, irritating atmosphere. 


The accepted theory is that Halon must 
decompose before it is effective in suppressing 
fire. The decomposition takes place on expo- 
sure to a flame or to a hot surface of approxi- 
mately 900° F. 


Depending on the severity of the fire, length of 
time Halon is exposed to flame, and concentra- 
tion of Halon, the decomposition products may 
be extensive or minimal. 


Notes: 
» Fire ports provide access to avionics bays 
* Fire ports are sized to fit portable fire 
extinguisher nozzle 


(& Fire port/guide (typical) 


FIRE PORT 
TYPICAL 


® Detail 


Avionics bays ЗА and ЗВ 
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Fire Port Locations 
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Тһе SMOKE DETECTION CIRCUIT TEST 
switch on panel L1 tests the smoke detection 
system, lights, and alarm circuitry. When the 
switch is positioned to A or B, electrical power 
is applied to the ACA channels controlling the 
AGENT DISCH lights, and the white lights are 
illuminated. Two tests are completed for both 
the A and the B circuits to test the complete 
logic circuitry of the smoke detection system. In 
one test, after approximately a 20-second delay, 
the SMOKE DETECTION A or B lights are 
illuminated, and the siren is triggered. In the 
other test, the SMOKE DETECTION CIRCUIT 
TEST switch is turned off in 5 to 10 seconds, 
bypassing the 20-second time delay and 
immediately annunciating a siren and a SMOKE 
DETECTION light (A or В). 


Once the alarm system has been triggered, it 
remains latched until the SMOKE DETECTION 
SENSOR switch on panel L1 is positioned to 
RESET. When the system is latched, the 
emergency alarm system will not activate an 
alarm in case of another fire in the same or any 
other avionics bay. 


Various parameters of the smoke detection 
system and remote fire extinguishing agent 
system are provided to telemetry. 
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Rapid Cabin Depressurization 


The cabin depressurization (dP/dt) sensor 
measures the rate at which cabin pressure is 
changing in the orbiter (in psi/min). The system 
alerts the crew to a rapid pressure change with 
respect to time by annunciation of the four 
MASTER ALARM pushbutton indicators and 
sounding of the klaxon (class 1 alarm) when the 
measured dP/dt value exceeds -0.08 psi/min. Тһе 
alarm only annunciates for negative values. The 
normal cabin dP/dt is zero psi per minute 
(£0.01) psi for all normal operations. 


In addition, a class 3 alarm will annunciate for a 
decrease in pressure greater than or equal to 
0.12 psi per minute, based on dP/dt or backup 
dP/dt. 


Values for dP/dt can be monitored on the SM 
SYS SUMM 1 (dP/dt, dP/dt-EQ, dP/dt-BU), 
and the dedicated display on panel O1 (dP/dt). 


The dP/dt detector is powered through the MN 
В РРО2 С CABIN DP/DT circuit breaker on 
panel 015. 
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ENVIRONMENT Display (DISP 66) 


Operations 


Primary C/W System 


The primary C/W system has three modes of 
operation: ascent, normal, and acknowledge. 
These modes are controlled by the CAUTION/ 
WARNING MODE switch on panel C3. The 
switch has three settings: ASCENT, NORM, and 
ACK. The normal mode is discussed first. 


The primary C/W system receives 120 inputs 
directly from transducers through signal 
conditioners or from the flight forward 
multiplexer/demultiplexers, and are fed into a 
multiplexing system. Of these 120 inputs, 95 
come directly from transducers, five are from 
the general purpose computer (GPC) input/output 
processors, 18 are provided by the GPC software, 
through multiplexer/demultiplexer, and two 
are spares. These inputs can be either analog or 
bilevel discretes. The analog signals are 0 to5 V 
DC; the discretes are either 2.5 or 5 V DC. All of 
these inputs are designed to provide upper or 
lower limit detection. If the parameter has 
exceeded its limits, it will turn on the C/W tone, 
light the appropriate light on panel F7, illuminate 
the four red MASTER ALARM pushbutton 
indicators, and store the parameter in memory. 


The C/W tone can be silenced and the red 
MASTER ALARM light extinguished Бу 
depressing any one of the MASTER ALARM 
pushbutton indicators; however, the C/W light 
on panel F7 will remain illuminated until the 
out-of-tolerance condition is corrected or 
inhibited. Any one of the MASTER ALARM 
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pushbutton indicators will reset all tones, 
including the systems management tone. 


АСА1 ACA 213 ! 


olol 


MN B PPO: C CABIN DP/DT Circuit 
Breaker on Panel 015 


The C/W ascent mode is the same as the normal 
mode, except that the commander's red 
MASTER ALARM pushbutton indicator will not 
be illuminated. 
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CAUTION/WARNING MEMORY and MODE 
Switches on Panel C3 


The C/W acknowledge mode is also the same as 
the normal mode, except that the 40 annunciator 
lights on panel F7 will not be illuminated unless 
one of the red MASTER ALARM pushbutton 
indicators (on panel F2 for the commander or 
panel F4 for the pilot) is depressed. 
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Panel R13U 


Each of the 120 status C/W red parameter lights 
on panel R13U receives an input from a specific 
parameter. A primary C/W parameter matrix 
cue card identifies the 120 input channels and 
correlates them to the panel F7 C/W 
annunciator light matrix. If an out-of-limit 
condition exists on a specific parameter that is 
set on panel R13U, it illuminates the 
corresponding light on panel F7. Ш the 
CAUTION/WARNING PARAM STATUS switch 
on panel R13U is held in the TRIPPED position 
when an out-of-limit parameter light on panel 
F7 is illuminated, the corresponding light on 
panel R13U will also be illuminated. 


Some limits, and the list of parameters 
monitored, change with flight phase. The crew 
uses the PARAM ENABLE/INHIBIT and LIMIT 
switches on panel R13U to tailor the C/W 
system for their current configuration. 


The three CAUTION/WARNING PARAMETER 
SELECT thumbwheels on panel R13U provide 
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signals to the C/W electronics unit to define a 
specific parameter. This is required for 
enabling and inhibiting the selected parameter 
and also for setting and reading a parameter's 
current limits. 


The CAUTION/WARNING LIMIT SET switch 
grouping on panel R13U is used to change 
limits or to read a parameter's limits. The three 
VALUE thumbwheels provide the signals to the 
C/W unit, defining the voltage value setting of 
a parameter's upper or lower limit, X.XX. 


The UPPER setting of the CAUTION/ WARNING 
LIMIT SET LIMIT switch on panel R13U provides 
a signal to the C/W electronics unit, which 
modes the electronics to set or read the upper 
limit of a parameter specified by the settings on 
the PARAMETER SELECT thumbwheels for that 
parameter. The CAUTION/ WARNING LIMIT 
SET FUNC switch is cycled to set or read the 
upper limit of that parameter. The LOVER 
setting functions in the same manner, except for 
the lower limit for a parameter. 
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The CAUTION/WARNING LIMIT SET FUNC 
SET switch position on panel R13U provides a 
signal to the C/W electronics unit, which sets 
the value specified by the LIMIT SET VALUE 
thumbwheels into the parameter as specified by 
the PARAMETER SELECT thumbwheels and 
LIMIT SET LIMIT switch. The LIMIT SET 
FUNC READ switch position on panel R13U 
provides a signal to the C/W electronics unit, 
which illuminates the lights under the STATUS 
LIMIT VOLTS X.XX columns on panel R13U 
that correspond to the voltage parameter limit 
specified by the PARAMETER SELECT 
thumbwheels and the LIMIT SET LIMIT switch. 
The value read corresponds to the parameter's 
full-scale range on a scale of zero to 5 volts DC. 
The LIMIT SET FUNC switch center position 
disables the set and read functions. 


The ENABLE position of the CAUTION/ 
WARNING PARAM switch on panel R13U 
provides a signal to the C/W electronics unit to 
enable the parameter indicated оп the 
PARAMETER SELECT thumbwheels, which 
allows the parameter to trigger the primary 
C/W alarm when out of limits. The INHIBIT 
position operates the same as ENABLE, except it 
inhibits the parameter from triggering the 
primary C/W alarm. The center position of the 
switch disables the enable and inhibit functions. 


The TRIPPED position of the CAUTION/ 
WARNING PARAM STATUS switch on panel 
R13U provides a signal to the C/W electronics 
unit, which illuminates the C/W status lights 
that correspond to the parameters that are 
presently out of limits, including those that are 
inhibited. The INHIBITED position illuminates 
those C/W lights on panel R13U that have been 
inhibited. The center position disables the 
tripped and inhibited functions. 


The CAUTION/WARNING MEMORY READ 
switch position on panel R13U provides a signal 
to the C/W electronics unit, which provides 
access to a memory buffer that stores inputs 
from parameters that are currently out of limits 
or have been out of limits since the memory 


buffer was last cleared. Moving {һе 
CAUTION/WARNING MEMORY switch 10 
READ displays the parameters that are 


currently out of limits or have been out of limits 
since the buffer was last cleared. The CLEAR 
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position on panel R13U or panel C3 provides a 
signal to the C/W electronics unit that clears 
from the memory any parameters that are back 
within limits, but any parameters that are out of 
limits during this action remain in memory. 
The center position of the switch on panel R13U 
or panel C3 disables the clear and read 
functions. 


The CAUTION/WARNING TONE VOLUME А 
potentiometer (recessed setscrew) on panel R13U, 
when adjusted clockwise, increases the system 
A siren, klaxon, C/W, and SM tone generator 
output signals to the audio central control unit. 
The B potentiometer functions the same as the A 
potentiometer for system B tone generators. 


The CAUTION/WARNING LAMP TEST switch 
on panel R13U, when positioned to LEFT, 
provides a signal to the C/W electronics unit, 
which illuminates the left five columns of the 
C/W status matrix lights on panel R13U. The 
RIGHT position functions the same as the LEFT, 
except for the right five columns of lights. This 
allows the verification of all 120 lights, making 
sure that none have burned out. 


Software (Backup) Caution and Warning 


When the software caution and warning system 
detects an out of limits condition, it sounds an 
aural tone or master alarm, lights the MASTER 
ALARM or SM ALERT light, and issues a fault 
message that is displayed flashing on the DPS 
display fault message line. The master alarm 
light and tones are reset by depressing a 
MASTER ALARM light pushbutton. The fault 
message will flash until acknowledged by a 
depression of the ACK key or until the MSG 
RESET key is depressed to erase the message. 
The MSG RESET key will also extinguish the 
SM ALERT light. 


The displayed fault message is used to diagnose 
system failures and frequently is used as the title 
of the Flight Data File procedure to be worked by 
the crew in response to the failure. The text of 
the fault message identifies the system where 
limits are being exceeded. A list of individual 
fault messages is presented in the summary at 
the end of this section. 


For some general classes of fault messages, the 
first part of the text contains the SPEC number 
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to be consulted to determine the specific 
parameter that is out of limits. The GPCs 
declaring the fault are enumerated after the 
message text. In parentheses at the end of the 
fault message, software will display the number 
of other fault messages generated while the 
current message was being displayed. To view 
these messages and the time at which they were 
annunciated, the crew must look at the fault 
summary page, or scroll through them using 
the ACK key. 


After reset of the displayed fault message, the 
message line will be blank until another new 
message is generated by the software. To avoid 
missing messages in a multi-failure scenario, 
crews should occasionally review all messages 
on the fault summary page and try to reset 
messages on the fault line as quickly as possible 
after reviewing them. 


Fault messages for some parameters are issued 
every time the software completes the required 
number of data counts with the parameter out 
of limits. This can result in a steady stream of 
fault messages and MASTER ALARMS that may 
obscure other important fault messages. If this 
situation is encountered, the crew or Mission 
Control can inhibit the affected parameter to 
prevent nuisance messages and alarms in OPS 2 
or OPS 4. In OPS 1, 6, or 3, the crew generally 
has to tolerate the extra alarms/fault messages 
and pay extra close attention to the fault 
summary display. 


In order to clear messages from the fault 
summary page, the crew enters a SPEC 99 PRO 
on the keyboard. If the fault summary (DISP 
99) is called up using a SPEC 99 PRO instead of 
the FAULT SUMM key, the fault summary page 
will appear, and then immediately clear itself. 


Software caution and warning limits for some 
parameters change depending on the phase of 
flight. These changes can be entered by the 
crew via the SPEC 60 TABLE MAINTENANCE 
display or uplinked from the ground. The 
ground uplink for limits changes is called a 
Table Maintenance Block Update (TMBU). 
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SPEC 60, SM Table Maintenance 


The primary avionics software system (PASS) 
includes three types of applications software, 
called major functions. The first, systems 
management (SM), is the function that is active 
on orbit. The second, guidance, navigation, and 
control (GNC), is active during all flight phases. 
The third, payload software, provides operations 
support to payloads. The backup flight system 
(BFS), normally used only during ascent and 
entry, also contains both SM and GNC software. 


Modules within both SM and GNC software 
monitor parameters and initiate alarms. To 
change the characteristics of the PASS GNC, BFS 
GNC, and BFS SM parameters, the crew would 
have to perform a GPC memory read/write 
procedure. (This procedure is described in the 
DPS HW/SW 21002 Training Manual.) 


However, PASS SM parameters can be accessed 
directly by the crew. Within PASS SM is a 
module called fault detection and annunciation. 
This module monitors the backup C/W and alert 
parameters and initiates alarms. 


SPEC 60 SM TABLE MAINT is the crew interface 
with the PASS SM parameters. Using SPEC 60, 
the crew can read and change the following for 
each PASS SM backup C/W or alert parameters: 
(1) lower and upper limits, (2) noise filter value, 
and (3) enable/inhibit status. Additionally, the 
crew can read and change SM program 
constants, initiate a checkpoint, and enable or 
inhibit the entire fault detection and annunciation 
software module. 


SPEC 60, which is a PASS SM SPEC, is available 
during SM OPS 2. When the SM TABLE MAINT 
display is called up by its SPEC number (SPEC 60 
PRO), each field will be blank except CHECKPT 
time and FDA ENA. When SPEC 60 is called by 
pressing RESUME, the fields that were 
previously in use will retain their data. When a 
legal item entry is made, the new data will be 
displayed in the appropriate field and will 
overwrite any previous data. 


Any Backup C/W or Alert parameter may be 
accessed by entering its software ID number in 
item 1 of the SM TABLE MAINT display. The 
limits, noise filter value, and enable/inhibit 
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status of Alert parameters may be changed with 
items 2 through 10. The same characteristics of 
Backup C/W parameters are available through 
items 11 through 15. These display parameters 
are discussed in more detail below. 
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SM TABLE MAINT (SPEC 60) 


PARAM ID (Item 1) and PARAM Value 


The software ID number for the desired fault 
detection and annunciation (FDA) parameters is 
entered in item 1. The software IDs are located 
in the C/W and FDF TABLE of the Flight Data 
File Reference Data Book. 


When a valid ID is entered, the ID number will 
be displayed in the PARAM ID space, and the 
current value of the parameter will be displayed 
in the PARAM VALUE field. The status of the 
parameter is indicated by the presence or 
absence of an up or down arrow. The 
appropriate ALERT or BACKUP C/W data will 
appear in the LIMITS portion (items 2 through 
10 or items 11 through 15 respectively). 


If the PARAM ID is not valid, all associated 
data fields will be blank, and an ILLEGAL 
ENTRY message will be displayed. 


Limits Alert Low and Hi (Items 2 through 7) 


These fields contain the upper and lower alert 
limits of the FDA parameter identified in item 1. 
The limit values are displayed in engineering 
units and can be changed by entering the 
desired data in the appropriate items. 
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Alert parameters that are preconditioned may 
have two or three limits sets. All other alert 
parameters have only one limit set. The SM 
software selects which set of limits is currently 
active and places an asterisk next to that set 
(before item 2, 4, or 6). (There is no item entry 
that allows the crew to move the asterisk to 
directly select which set of limits is active. This 
is done exclusively by software.) If only one set 
of limits exists for the parameter, this set will be 
displayed in the first limit set location, and the 
asterisk will be placed by item 2. If a value is 
entered in a limit set that does not exist for the 
selected parameter, an illegal entry message 
will be displayed. 


Limits Backup C/W Low and Hi 
(Items 11 and 12) 


Тһе backup C/W system limits for the FDA 
parameter identified in item 1 are displayed in 
these fields. Тһе limit values, which are іп 
engineering units, can be changed by entering 
the new data in the desired item. Backup C/W 
parameters have one set of limits. 


Limits Alert Filter (Item 8) 


Тһе Alert parameter noise filter value can be 
read or changed through item 8. It is the num- 
ber of consecutive times the parameter has to be 
sensed out of limits before an alarm 
annunciates. The reverse is true for returning 
back into limits. The range of valid values is 1 
through 15. 


Limits Backup C/W Filter (Item 13) 


The backup C/W filter functions similarly to 
the Alert filter (item 8). 


Limits Alert ENA or INH (Items 9 and 10) 


Тһе annunciation of an out-of-limits Alert 
parameter may be either enabled or inhibited by 
executing the respective item. The items are 
mutually exclusive, and an asterisk indicates 
the current annunciation status by appearing 
after the more recently selected item. 


The class 0 status indicators (up and down 
arrows) and transducer data symbols (H, L, M, 
?) are not affected by this item. 
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Limits Backup C/W ENA or INH 
(Items 14 and 15) 


These backup C/W items operate similarly to 
the Alert items 9 and 10. 


FDA ENA or INH (Items 19 and 20) 


The PASS FDA software can be either inhibited 
or enabled by executing the respective item. 
The items are mutually exclusive, and an 
asterisk denotes the current state. The display 
is initialized with FDA enabled. 


When FDA is inhibited, the following FDA 
functions are disabled: 


e FDA alarm annunciation. This includes 
backup C/W (class 2), Alert (class 3), 
and limit sensing up or down arrows 
(class 0). 


e Limit sensing (class 0). The last value of 
each out-of-limits parameters status 
indicator is displayed. 


e Precondition steering. 
e False alarm avoidance noise filters. 


Other parameter status indicators (H, L, M, ?) 
are not affected because they are not generated 
by the FDA software. 


Constants 


SM constants may be accessed through items 16 
and 17. These constants are primarily involved 
in SM special processes such as water loop 
pump cycling, alert preconditioning, and 
payload deployment. 


Constant ID (Item 16) 


When a constant ID number is entered in item 
16, both the CONSTANT ID and VALUE fields 
are filled. If the ID was illegal, both data fields 
are blanked. 


The constant IDs and values are not typically 
carried onboard the orbiter, although various 
malfunction procedures contain occasional 
constants. If a constant must be changed, 
Mission Control will either provide the crew 
with the data or directly change the constant 
through a TMB Uplink. (See TMBU description 
in this section.) 
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Constant Value (Item 17) 


This field contains the current value of the 
constant identified in item 16. The constant value 
can be changed by entering the new data in item 
17. 


TMBU 
TMBU is the type of uplink that Mission 


Control uses to change the following data: 
e Parameter limit values 
• Parameter noise filter values 


e Parameter annunciation enable/ inhibit 
status 


e SM constant values 


The use of TMBUs decreases the crew's 
workload because the changes that are uplinked 
do not have to be entered on SPEC 60. 


SPEC 60 operations and TMBUs are interlocked 
such that TMBU loads are rejected if SPEC 60 is 
active. If a TMBU is in progress when SPEC 60 
is called, the flashing words UPLINK and UL 
will be displayed on the display, and all item 
entries will be prohibited by an ILLEGAL 
ENTRY message. 


Uplink 


The flashing word UPLINK is displayed in the 
top center of SPEC 60 to indicate that a TMBU is 
in progress. 


UL 


When any two-stage command (including a 
ТМВО) is uplinked, a flashing UL is displayed 
in the upper right corner of all DPS displays 
associated with the GPC(s) that are being 
commanded. 


Checkpoints 


When a checkpoint is performed, the following 
information is saved in a mass memory unit: 


e Parameter limit values 
e Parameter noise filter values 


e Parameter annunciation enable/ inhibit 
status 


2. SYSTEMS 
2.2 Caution and Warning System (C/W) 


USA007587 
Rev. A 


e SM constant values 


• Checkpoint timetags 


The checkpoint capability is valuable because 
changes made through item entries on SPEC 60 
affect only the SM GPC software and not the 
mass memory unit software. If these changes 
are not saved in a mass memory unit, and the 
SM GPC fails, flight software will lose the 
changes that have been made. The changes 
would then have to be reentered. 


When checkpoint retrieval is enabled, the 
software loaded into an SM GPC from a mass 
memory unit will contain the most recent 
version of changes saved during checkpoint. 


Checkpoint Initiate (Item 18), Checkpoint 
Status, and Time 


When item 18 is executed, the STATUS field 
will go blank. While the checkpoint is being 
performed, a flashing BSY will be displayed 
next to SM COMM BUFF at the top left of SPEC 
60. This indicates that the SM communications 
buffer is in use. When the checkpoint is 
completed, the CHECK PT STATUS field will 
contain GOOD. Ш the SM common buffer was 
not available, CHECK PT STATUS will be FAIL, 
and item 18 should be executed again. 
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The mission elapsed time (MET) of the most 
recent successful checkpoint will be displayed 
as DD/ HH:MM:SS, in the checkpoint time field. 


SM COMM BUFF - BSY, or RDY 


Either a flashing BSY or a status RDY is 
displayed after SM COMM BUFF to indicate the 
status of the SM Common Buffer. BSY (busy) 
indicates that the SM COMM BUFF is being 
used; RDY (ready) means the buffer is available. 
Keypad entries are rejected if BSY is flashing. 


СКРТ ВЕТКУ ENA (SPEC 1, Item 12) 


Executing this item will alternately select or 
deselect СКРТ RETRV ЕМА. Ап asterisk 
appears next to item 12 when checkpoint 
retrieval is enabled. 


MMU Assignment 
(DPS Utility - SPEC 1, Items 3 and 4) 


A checkpoint saves the changes in the mass 
memory unit assigned to the SM software by 
item 3 or 4. In order to save the checkpoint in 
both, two checkpoints must be performed. 
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C/W Summary Data 


The C/W system consists of four alarm 
classes: emergency (class 1), C/W (class 2), 
alert (class 3), and limit sensing (class 0). 


Emergency alarms cover two situations: 
smoke detection/fire suppression and cabin 
pressure. 


Smoke detection and fire suppression 
capabilities are provided in the crew cabin 
avionics bays, the crew cabin, and the 
pressurized payload modules. 


Increased smoke particle concentration will 
illuminate SMOKE DETECTION lights on 
panel L1, illuminate four red MASTER 
ALARM lights on panels F2, F4, A7, and 
MO52J, and sound the siren in the crew 
cabin. 


Fire suppression in the crew cabin avionics 
bay is provided by one permanent Halon 
extinguisher bottle in avionics bays 1, 2, and 
3A. The bottle is operated by switches on 
panel L1. 


Three portable hand-held extinguishers in 
the crew cabin are operated by inserting 
them into fire holes located in several display 
and control panels. 


A class 1 alarm (four MASTER ALARM 
pushbutton indicators and the sounding of 
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the klaxon) is triggered when there is a rapid 
change in cabin pressure with respect to 
time. 


Class 2 alarms include primary (hardware) 
and backup (software) systems. The crew 
interfaces with the primary C/W system 
through the 40-light annunciator matrix on 
panel F7 and a 120-parameter monitor on 
panel R13U. The interface with the backup 
(software) system is via software messages 
and SPEC 60 TABLE MAINT. 


Some Class 3 alerts warn the crew of a 
situation leading up to a class 2 alarm or of 
one that may require a long procedure. 


Class 0, a software system, consists of up and 
down arrows displayed on the DPS displays 
next to a parameter. 


The SPEC 60 TABLE MAINT display allows 
the crew to change limits, noise filter values, 
and status of backup C/W or alert system 
parameters. 


Pressing the MASTER ALARM light will 
silence the alarm and reset the light. 


Pressing the ACK key will stop the fault 
messages from flashing. Subsequent 
pressing of ACK key will scroll through fault 
messages. 


Pressing the MSG RESET key will erase fault 
messages from the DPS displays and 
extinguish the SM ALERT light. 


C/W Rules of Thumb 
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The SENSOR RESET switch on panel 11 
should be pressed when smoke concentration 
goes below 1.8. This prevents masking of 
alarms. 


When panel R13U is not in use, the 
PARAMETER SELECT thumbwheels should 
be set to a value greater than 119. 


Crewmembers should reset fault messages as 
quickly as possible after review to avoid 
covering other messages. 


The fault summary should be reviewed 
regularly to avoid missed fault messages. 
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F7 Light Summary 


NOTE 


A Class 2 audible tone and MASTER 
ALARM lights accompany the appropri- 
ate C/W light. Most lights are hardware- 
driven, but many parameters are also 
software-sensed by the PASS or BFS 
GPCs. The software provides a GPC fault 
message and illuminates the BACKUP 
CW ALARM light. The hardware chan- 
nels listed below are the same as the 
channels on the C/W STATUS light 
matrix on panel R13U. The color of each 
light is indicated by (R) for red and (Y) for 
yellow. 


O2 PRESS (Y): Indicates an O2 tank 1, 2, 3, or 4 
pressure or the O2 kit (Tank 5) pressure out of 
limits. The hardware channels are 0, 10, 20, 30, 
and 40 for Tanks 1, 2, 3, 4, and 5, respectively. 


H2 PRESS (Y): Indicates either an H2 Tank 1, 2, 
3, or 4 pressure or the H2 kit (Tank 5) pressure 
out of limits. The hardware channels are 50, 60, 
70, 80, and 90 for Tanks 1, 2, 3, 4, and 5, 
respectively. 


FUEL CELL REAC (R): Indicates an O2 or H2 
Fuel Cell 1, 2, or 3 reactant valve is closed. The 
hardware channels are 2, 12, 22, 32, 42, and 52 
for FC 1, 2, and 3 O2 and Н2, respectively. 


FUEL CELL STACK TEMP (Y): Indicates a Fuel 
Cell 1, 2, or 3 stack temperature out of limits. 
The hardware channels are 62, 72, and 82 for FC 
1, 2, and 3, respectively. 


FUEL CELL PUMP (Y): Indicates a Fuel Cell 1, 
2, or 3 pump AP out of limits. The hardware 
channels are 92, 102, and 112 for FC 1, 2, and 3, 
respectively. 


CABIN ATM (R): Indicates either cabin 
pressure, PPO2, O2 flow rate, or N2 flow rate 
out of limits. The hardware channels are 4, 14, 
24, 34, 44, 54, and 64 for cabin press, O2 SYS 1 
and 2 flow rate, PPO2 A and B, and N2 SYS 1 
and 2 flow rate, respectively. 


O2 HEATER TEMP (Y): Indicates an O2 Tank 1, 
2, 3, or 4 heater temp or O2 kit (Tank 5) heater 
temp out of limits. The hardware channels are 
1, 11, 21, 31, 41, 51, 61, 71, and 81 for O2 Tank 1 
НТК Тапа 2, Tank 2 НТК 1 and 2, Tank 3 НТК 
1 and 2, Tank 4 HTR 1 and 2, and Tank 5, 
respectively. 
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F7 Light Summary (continued) 


MAIN BUS UNDERVOLT (К): Indicates main 
bus A, B, or C voltage low. The hardware 
channels are 3, 13, and 23 for main bus A, B, 
and C respectively. 


AC VOLTAGE (Y): Indicates AC bus 1, 2, or 3 
phase A, B, or C out of limits. The hardware 
channels are 33, 43, and 53 for AC bus 1, 2, and 
3 respectively. 


AC OVERLOAD (Y): Indicates an inverter 1, 2, 
or 3 phase A, B, or C output of 225 percent 
overload for 20 sec or 300 percent for 4 to 6 sec. 
The hardware channels are 63, 73, and 83 for 
inverter 1, 2, and 3 respectively. 


FREON LOOP (R): Indicates a low Freon loop 
1 or 2 flow rate or a temperature out of limits. 
The hardware channels are 106, 116, 107, and 
117 for loop 1 and 2 flow rate, and loop 1 and 2 
temp respectively. 


AV BAY/CABIN AIR (Y): Indicates out of limits 
condition on cabin fan AP, AV Bay 1, 2, or 3 air 
out temp, or cabin heat exchanger air temp. The 
hardware channels are 74, 84, 94, 104, and 114 
for cabin fan AP, AV Bay 1, 2, or 3 Temp, and 
CAB HX temp respectively. 


IMU (Y): Indicates detection of ап inertial 
measurement unit (IMU) failure or dilemma. 
The hardware channel is 103 and is a discrete 
driven from the GNC software. 


FWD RCS (R): Indicates detection of an out of 
limits condition on a forward RCS oxidizer tank 
ullage pressure, fuel tank ullage pressure, or 
forward oxidizer or fuel leak. The hardware 
channels are 6, 16, and 26 for oxidizer tank 
press, fuel tank press, and leak respectively. 


RCS JET (Y): Indicates detection of an RCS jet 
failed on, failed off, or leaking. The hardware 
channel is 96 and is a discrete driven from the 
GNC software. 


Н20 LOOP (Y): Indicates an out of limits 
condition on Н:О loop 1 or 2 pump out 
pressure. The hardware channels are 105 and 
115 for loop 1 and 2 respectively. 
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RGA/ACCEL (Y): Indicates detection of a rate 
gyro assembly (RGA) 1, 2, 3, or 4 failure, or an 
accelerometer 1, 2, 3, or 4 failure. The hardware 
channel is 93 and is a discrete driven from the 
GNC software. 


AIR DATA (R): Indicates detection of an air 
data transducer assembly (ADTA) dilemma. 
The hardware channel is 91 and is a discrete 
driven from the GNC software. 


LEFT RCS (R): Indicates detection of a left RCS 
oxidizer, fuel tank ullage pressure out of limits, 
or left oxidizer or fuel leak. The hardware 
channels are 36, 46, and 56 for oxidizer tank 
press, fuel tank press, and leak respectively. 


RIGHT RCS (R): Indicates detection of a right 
RCS oxidizer, fuel tank ullage pressure out of 
limits, or right oxidizer or fuel tank leak. The 
hardware channels are 66, 76, and 86 for 
oxidizer tank press, fuel tank press, and leak 
respectively. 


SPARE: Available for future warning parame- 
ter growth. 


LEFT RHC (R): Indicates detection of a left 
rotational hand controller (RHC) pitch, roll, and 
yaw disagree. The hardware channel is 100 and 
is a discrete driven from the GNC software. 


RIGHT/AFT RHC (R): Indicates detection of a 
right or aft RHC pitch, roll, or yaw disagree. 
The hardware channel is 110 and is a discrete 
driven from the GNC software. 


LEFT OMS (R): Indicates detection of a left 
OMS pod oxidizer, fuel tank ullage pressure out 
of limits, or an engine abnormal (OMS engine 
fail to cutoff, fail to ignite, or early shutdown) 
condition. The hardware channels are 37, 47, 
and 57 for the oxidizer, fuel tank press, and 
engine abnormal respectively. The hardware 
channels are 7, 17, and 27 for the oxidizer, fuel 
tank press, and engine abnormal respectively. 


RIGHT OMS (R): Indicates detection of a right 
OMS pod fuel tank ullage pressure out of limits, 
or an engine abnormal (OMS engine fail to 
ignite, or early shutdown) condition. 
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F7 Light Summary (continued) 


PAYLOAD WARNING (R): Indicates detection 
of up to five payload parameter inputs out of 
limits. The hardware channels are 55, 65, 75, 85, 
and 95. 


GPC (Y): Indicates GPC 1, 2, 3, 4, or 5 has 
determined itself failed and issued a self-fail 
discrete. The hardware channels are 5, 15, 25, 
35, and 45 for GPC 1, 2, 3, 4, and 5 respectively. 


FCS SATURATION (Y): Indicates detection of 
elevon position or hinge moment saturation. 
The channel is 101 and is a discrete driven from 
the GNC software. 


OMS KIT (Y): Indicates detection of an OMS kit 
oxidizer or fuel tank ullage pressure out of 
limits. The hardware channels are 77 and 87 for 
oxidizer and fuel respectively. 


OMS TVC (R): Indicates detection of an OMS 
pitch or yaw gimbal failure. The hardware 
channel is 67. An OMS TVC failure may also 
result in a LEFT or RIGHT OMS light. 


PAYLOAD CAUTION (Y): Indicates detection 
of a payload parameter input out of limits. The 
hardware channel is 97 and is not presently 
implemented. 


PRIMARY C/W (Y): Indicates detection of a 
C/W system self-test failure internal to the 
C/W EU. The failures include the loss of power 
supply A or B, loss of A or B timing, or the 
inability of a C/W self-test parameter to pass 
limit check. Мо channel number. The 
parameter is internal to the C/W unit hardware 
itself. The light also illuminates each time the 
ESS 1BC C/W A circuit breaker is closed after 
being opened and extinguishes when the 
MASTER ALARM pushbutton indicator is 
depressed. 
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FCS CHANNEL (Y): Indicates detection of an 
elevon, rudder, or speedbrake actuator failure, 
SRB rock or tilt actuator failure, or MPS engine 
pitch and yaw actuator failure. The hardware 
channel is 111 and is a discrete driven from the 
GNC software. 


MPS (R): Indicates detection of an MPS engine 
He tank press, He regulator out press, LO2 
manifold press, or LH2 manifold press out of 
limits. The hardware channels are 9, 19, 29, 39, 
49, 59, 69, and 79 for Engine 1, 2, and 3 He TK, 
He reg, and LO2 and LH2 pressure respectively. 


SPARE (R) Available for future warning 
parameter growth. 


BACKUP C/W ALARM (R): Indicates detection 
of a C/W alarm via SM, СМС, or BFS software 
monitoring. In OPS 2 SM parameter limits can 
be accessed, changed, enabled, and inhibited 
through SPEC 60 TABLE MAINT display. 


APU TEMP (Y): Indicates an APU 1, 2, or 3 
exhaust gas temp or lube oil temp out of limits. 
The hardware channels are 8, 18, 28, 38, 48, and 
58 for APU 1, 2, and 3 EGT and lube oil temp 
respectively. 


APU OVERSPEED (Y): Indicates an APU 1, 2, 
or 3 speed greater than a specified percentage of 
the designed speed. The hardware channels are 
68, 78, and 88 for APU 1, 2, and 3 respectively. 


APU UNDERSPEED (Y): Indicates an APU 1, 2, 
or 3 speed less than a specified percentage of 
the designed speed. The hardware channels are 
98, 108, and 118 for APU 1, 2, and 3 
respectively. 


HYD PRESS (Y): Indicates a hydraulics system 
1, 2, or 3 supply pressure out of limits. The 
hardware channels are 99, 109, and 119 for APU 
1, 2, and 3 respectively. 
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Fault Message Table 


The fault message table located in the FDF 
Reference Data Book provides a reference to 
software-generated 
The following explains the table 


crewmembers all 


messages. 


оп 


and a typical fault message table is shown. 


Message 


exact message annunciated. 


OPS 
availability 


PASS a 


Comments 


The message column notes the 


This column is broken into 
two subcolumns: 


nd 


BFS. Under each subcolumn is 
a list of GPC Operational 
Sequences (OPS) in which a 


particular 
received. 


Cause 
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This column lists the possible 


causes that drive the message. 
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column provides 


Clarifies conditions that 
must be present for a 
message to be annunciated. 
For example, ап FRCS 
LEAK message is generated 
for an OX/FUA QTY >9.5 
percent, which is indicated 
by a bilevel discrete. 


Identifies conditions with 
no corresponding long form 
malfunction procedure (in 
other words, NO MAL. 


Identifies procedures ог 
actions required when it is 
not clear. For example, the 
RCS LEAK ISOL PKT C/L 
procedure should be used 
for an F RCS He P msg. 


Identifies impacts. 
Examples include “quantity 
calculation suspended” and 
“cause termination of auto 
sequence.” 
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2.3 CLOSED CIRCUIT TELEVISION 
(CCTV) 


CONTENTS 


Description 

CCTV Cameras 

Video Processing Equipment 
CCTV Camera Lens Control 
Pan/ Tilt Units (PTUs) 


Cabin Cameras 


Description 


The closed circuit television (CCTV) system is 
used on orbit to provide support to orbiter and 
payload activities. This support includes trans- 
mitting real-time and recorded video from the 
orbiter to Mission Control Center through the 
S-band FM, S-Band PM, or Ku-band communi- 
cations systems. Ku-band can be either analog 
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camera configurations are specified in the Flight 
Requirements Document for each shuttle flight. 


The CCTV system consists of video processing 
equipment, TV cameras, pan/tilt units (PTUs), 
camcorders, video tape recorders (VTRs), color 
television monitors (CTVMs), and all the 
cabling and accessories required to make these 
components work together. The crew can 
control almost all CCTV operations. Most 
CCTV configuration commands can be executed 
by the Instrumentation and Communications 
Officer (INCO) at Mission Control Center 
(MCC). Among the commands MCC cannot 
uplink are those to configure and operate loose 
CCTV equipment, such as camcorders and 
VTRs, wireless video system (WVS), digital 
television (DTV) system, and the selection of 
inputs to the color monitors. 


Standard CCTV components are powered via 
circuit breakers located on panel R14. Flight- 
specific keel cameras (prox ops or berthing) are 
usually powered from a cabin payload bus. 
CCTV pushbuttons on panel A7U have lights to 
illuminate visual feedback on camera and 
CCTV routing configuration. These lights are 
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Payload Bay CCTV Camera Locations 


CCTV Cameras 


Three types of CCTV cameras are flown in the 
payload bay. The cameras are designated as 
color television camera (СТУС), intensified 
television camera (ITVC), and Videospection. 
The ITVC and Videospection camera are black- 
and-white (B&W) cameras. Camera names and 
locations are shown in the above diagram. 


Some missions require additional cameras in 
the payload bay. These cameras are usually 
positioned in one or more of four keel camera 
mounts. Occasionally, these cameras are 
mounted on payload support structures and are 
used to assist with berthing operations. А 
CTVC mounted in the orbiter docking system 
(ODS) is used for docking missions as a 
centerline camera. The Videospection camera is 
used on a flight-specific basis. 


All payload bay CCTV cameras have heaters for 
both the camera and the PTUs. These heaters 
are independently powered from circuit 
breakers located on panel R14. The heaters are 
thermostatically controlled and activate when 
the temperature reaches -8° C and turn off at 0° 
C. All CCTV cameras and PTUs in the payload 
bay are covered with thermal blankets. 


Field sequential color (FSC) was selected by the 
Space Shuttle Program (SSP) as the color video 
standard rather than the National Television 
Standards Committee (NTSC) standard because 
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NTSC cameras in the 1970s were much larger and 
consumed more power than their FSC 
counterparts. Ш addition, FSC cameras 
performed well for the Apollo program in the late 
1960s and early 1970s. Today, miniaturization of 
electronics allows NTSC cameras (both CCTV and 
camcorders) to occupy a smaller volume and 
consume less power than in years past. The SSP 
retired the FSC lens assemblies and use only color 
or black and white NTSC cameras. 


Color Television Camera (CTVC) 


The СТУС provides an RS-170A (NTSC) color 
video signal that does not require additional 
processing in MCC prior to distribution to the 
media. NTSC is the color video standard in 
North America, Japan, and other areas. Great 
Britain and France are among nations with 
television standards other than NTSC. 


The СТУС overall size is 16.0 inches long, 5.88 
inches wide, and 5.94 inches high. The CTVC 
lens is encased within the CTVC housing. The 
CTVC has a maximum horizontal field-of-view 
of 77° and a minimum of about 9°. The CTVC 
uses three charge-coupled devices (CCDs) to take 
discrete samples of light passing through a prism 
after entering the lens. The red, green, and blue 
(RGB) light separated by the prism is directed to 
RGB CCDs. The CCDs are strobed by the 
camera's timing circuits to provide RGB 
component signals. The RGB signals аге 
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processed independently to provide color 
balancing. Payload bay floodlights, compact 
portable lights (CPLs) in the cabin, and sunlight 
are composed of different light spectra. 


The nomenclature on the MENU and MODE 
pushbutton indicators (PBIs) is no longer used. 
A CTVC decal is used to assist crews in 
operating the CIVCs. This menu system for 
configuring the CTVCs provides control of the 
CTVC operating modes using existing PBIs and 
uplink commands. 


Color Television Camera (CTVC) 
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CTVC Decal 


Intensified Television Camera 


The ITVC is essentially a B&W version of the 
CTVC. The automatic light control (ALC), 
manual gain, and gamma settings are exactly 
the same. However, the ITVC has only one 
CCD (versus the three on CIVC) and is 
optimized for a low-light environment. Instead 
of color balance, the ITVC includes day and 
night operating modes. The night mode pro- 
vides additional gain, which can be used with 
any ALC setting as well as manual gain 
settings. This feature allows a high gain option 
without sacrificing the ALC protection, 
particularly around orbital sunrise. A 
combination of night mode and manual gain 24 
dB will make the ITVC sensitive down to 0.03 
lux and provide a full-level output at around 
0.02 lux. 
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CCTV Circuit Breakers on Panel R14 
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If the night mode is used with daylight, the 
video will appear granular (noisy). The daylight 
mode essentially deactivates the night mode. 
The ITVCs also include an aperture correction 
(AP COR) that provides finer detail (improves 
resolution) if there is enough light. In low light 
conditions, the scene will look better if AP COR 
is off. Power-on defaults are similar to the 
ITVC. Manual mode of 0 dB is displayed on 
panel A7U and night operation mode and 
gamma black stretch are active іп the 
background. The ITVC is configured using the 
CTVC decal. 


Intensified Television Camera (ITVC) 


Camera Power 


The CTVC and ITVC cameras have three 
associated circuit breakers (cbs) on R14: 
CAMR/PTU, CAMR HTR, and ILLUM/PTU 
HTR. In order to operate a camera, the 
appropriate CAMR/PTU cb needs to be pushed 
in. This cb also provides power to the PTU. 
The CAMR НТК cb provides power to each 
camera heater circuit that is thermostatically 
controlled. The РТО НТК enables the PTU 
heater circuits that are thermostatically 
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controlled and also enables the logic for 
activating light emitting diode (LED) 
illuminators when flown. 


Videospection Camera 


The Videospection camera is a simple fixed 
focus, fixed field-of-view, B&W camera. It is 
either on or off, with no available controls to 
adjust the video it produces. It does 
automatically open and close its iris to adjust 
for different light settings. It is powered via a 
standard switch panel switch. It has been used 
as a keel/berthing camera for various payloads. 
It has also been attached to the remote 
manipulator system (RMS) end effector to 
provide a side view compared to the end 
effector camera. Due to this configuration, it 
has been known as the special purpose end 
effector (SPEE) camera or the RMS sideview 
camera (RSC). Like the CTVC and ПУС, it can 
also accommodate an LED illuminator to aid its 
low-light viewing situations. However, its 
illuminator may be a three-way illuminator that 
has low, medium, and high intensity settings. 
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Video Processing Equipment 


The video control unit (VCU) is the central 
processor/controller for the CCTV system. The 
VCU consists of two line replaceable units 
(LRUs): the remote control unit (RCU) and the 
video switching unit (VSU). Both LRUs are 
located behind panels R17 and R18 in the aft 
flight deck. These units are forced air cooled by 
cabin fans, although neither LRU includes a 
temperature sensor. An extension of the VSU is 
the video processing unit (VPU), which allows 
for more video interfaces than the VSU can 
provide. It is located in panel R12. The latest 
addition to the Shuttle video processing 
equipment is the DTV system, which is located 
at 1101. Finally, one non-installed piece of 
equipment is the sequential still video (SSV) 
system that allows the shuttle to send sequential 
still video snapshots to MCC during Ku-band 
loss of signal (LOS) periods. 


Remote Control Unit 


The RCU receives all CCTV commands from 
both the crew and MCC. Ground command 
interface logic (GCIL) control switch located on 
panel A7U determines whether MCC can send 
commands to the CCTV system. When the TV 
POWER CONTROL switch is in the CMD 
position, MCC can uplink commands to the 
CCTV system, and the crew will be able to use 
all panel A7U TV switches except the TV 
POWER CONTR UNIT MN A / OFF / ММВ 
switch. This TV POWER CONTR UNIT switch 
enables GCIL drivers to power up the VCU 
through either DC Main A or B via panel R14, 
thus this is the one true GCIL switch. The GCIL 
drivers prevent the crew and MCC from 
activating or deactivating the VCU 
simultaneously. When the GCIL TV POWER 
CONTROL switch is in PANEL, the crew can 
configure the TV POWER CONTR UNIT switch 
to provide VCU power or to turn the VCU off. 
All uplink commands to the CCTV system are 
inhibited when the GCIL switch is in PANEL. 
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TV POWER Controls on Panel A7U 


Uplink commands to the RCU must pass through 
payload 2 mutiltiplexer/demultiplexer (РЕ2 
MDM). The VCU power MN A / OFF / MN B 
commands to the ССП. drivers use PF1 ог PF2 
MDM like all other GCIL commands. However, 
if the GCIL Main C circuit power provided from 
panel R14 were to fail, the RCU will inhibit all 
uplink CCTV commands, except for the VCU 
power-on commands. The crew can send any 
uplink CCTV command by executing a real-time 
command (RTC) оп SPEC1 of the Systems 
Management General Purpose Computer (5M 
GPC). The TV POWER CONTROL switch must 
be in the CMD position for crews to use this 
feature. Crews do not carry any CCTV specific 
КТС in any Flight Data File (FDF) documents. 
This capability would only be used if MCC were 
unable to uplink commands or for functions not 
available from panel A7U. The RCU includes two 
independent video sync generators. The sync 
generators are tied to the power on logic and TV 
SYNC NORMAL/REVERSE switch on panel 
А70. 


When the TV SYNC switch is in NORMAL, sync 
generator A is powered by Main A with sync 
generator B on Main B. The bus that powers the 
VCU also applies power to the sync generator 
tied to that bus. When the TV SYNC switch is in 
REVERSE, sync generator A is tied to Main B and 
sync generator B is tied to Main A. This feature is 
provided to allow the crew to switch sync 
generators without power cycling the VCU in 
case of a sync generator failure. MCC can see the 
status of this switch, but cannot send a command 
to switch sync generators without switching 
main bus power sources. 


In addition to generating master sync signals, 
the RCU also generates a full-field test signal, 
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better known аз а test pattern. The test pattern 
is black and white. The test pattern can be 
selected as a video source from panel A7U or 
via an uplink command. 


The sync signal is distributed to CCTV cameras 
and the VSU for synchronization purposes. 
Commands to the cameras are embedded in the 
sync signal. Each camera has a unique address. 
This address is sent out with the command in 
the sync signal. Therefore, only the correctly 
addressed camera will respond to the 
command. Uplinked commands are sent on a 
different sync (horizontal scanning) line than 
A7U commands. It is possible for the crew and 
MCC to send conflicting commands to a camera 
at the same time; coordination between crew 
and MCC is very important to prevent potential 
conflicts. Usually, the crew configures cameras 
and MCC selects cameras for downlink. Prior 
to launch, each crew should talk with the lead 
INCO for their flight to work out CCTV 
responsibilities during crew activity and sleep 
shifts. 


The crew activates payload bay cameras using 
the TV CAMERA POWER switches located at 
the top of panel A7U. These switches are 
momentary in both the ON and OFF positions. 
The ON/OFF talkbacks are set by the RCU. The 
talkbacks indicate the status of a 28 V dc 
discrete signal that enables a remote power 
controller (RPC) to provide panel R14 circuit 
breaker power to a payload bay camera and 
PTU. The talkback status can be misleading 
because the talkback can indicate ON when the 
circuit breaker that provides power to the 
camera is out. Crews should always use these 
switches to power off the cameras prior to 
deactivating the VCU to ensure correct camera 
powerdown. 
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ТУ DOWN LINK switch on Panel A7U 


There are two RMS camera switches to note. In 
addition to the RMS TV CAMERA POWER 
switch, another RMS camera switch is located 
below the aft rotational hand controller (RHC) 
on panel А7Џ. The RMS CAMERA 
WRIST/ELBOW select switches toggle between 
the wrist (end effector) and elbow cameras. 
Only one RMS camera can be activated at a 
time. Cycling the switch powers off one camera 
and powers on the other. MCC cannot select 
between the wrist and elbow cameras nor can 
MCC identify the position of the switch using 
downlinked telemetry. 


In addition to TV SYNC NORMAL/REVERSE 
and RMS CAMERA WRIST/ELBOW switches, 
MCC is unable to configure the ТУ 
DOWNLINK ENABLE/INHIBIT switch func- 
tion. This lever lock switch inhibits the VSU 
output to the analog downlink Ku-Band and 
S-Band FM communications systems. This 
switch can be used to ensure that no video is 


downlinked during "sensitive" mission 
operations. For the majority of mission 
operations, this switch should be in the 


ENABLE position. MCC receives telemetry that 
indicates the position of the TV DOWNLINK 
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switch. For DTV, this enable/ inhibit function 
is performed by the MUX/ VTR/CC switch on 
the DTV MUX on panel L10L. 


The RCU provides some telemetry to the pulse 
code modulation master unit (PCMMU) via OF4 
MDM. This includes camera overtemp, 
downlink enable, VCU power source, sync 
normal/reverse, sync generator active, and 
"camera select." The camera select is the camera 
selected for downlink. This may be a different 
camera from the one the crew or MCC is 
commanding at the time. The crew and MCC 
can command different cameras at the same 
time. The ALC/Gamma status of the downlink 
camera will be included in the telemetry to the 
PCMMU. 


Video Switching Unit (VSU) 


The VSU can accommodate up to 13 video 
inputs and 7 outputs. However, panel A7U 
only provides for 10 inputs and 4 outputs. 
Adding pushbuttons to expand the VSU oper- 
ational capability has been determined by the 
SSP as being too expensive for the increase in 
capability and is planned for the advanced 
VPU. 


The VSU is used to route video from a source to a 
destination. All commands to the VSU are 
processed by the RCU before being sent to the 
VSU. Note that the crew routes video by 
selecting a destination and then а source, 
whereas MCC selects a source and then a 
destination. When the crew selects a destination 
on panel A7U, that output PBI illuminates. Once 
an input is selected for that particular output, the 
input PBI will illuminate as well. If the input is a 
camera, the crew can select ALC/Gamma PBI 
settings and/or send PTU/lens commands to 
that camera and pan/ tilt unit. 


The VSU is synchronized to the RCU via the 
sync generators. This allows the VSU to change 
video sources for a destination at the end of a 
video field to prevent visible picture distortion 
when the video switches engage. The 
synchronization of the CCTV also allows the 
VSU to read CCTV camera telemetry. The VSU 
can read camera ID, temperature, and pan/tilt 
angles. If the VSU detects a camera exceeding 
45° Celsius, an overtemp warning is sent to the 
RCU. The RCU sets a telemetry bit high so that 
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the SM GPC will annunciate a SM Alert and a 
576 COMM CAM TEMP message. Тһе 
temperature limit is set in the VSU and cannot be 
changed by a table maintenance block update 
(TMBU). A TMBU can be used to inhibit the SM 
alert and message. 


The VSU is also capable of generating multiplex 
(mux) scenes that appear as a split screen of two 
CCTV cameras. The VSU takes the center 
portion of a camera scene and places it on the left 
or the right side of the mux picture. The VSU 
determines where to extract the center portion of 
the video source from the RCU’s sync signals. 
The VSU can only mux synchronous video 
sources. VTR playback and camcorders cannot 
be muxed by the VSU. 


The VSU receives GMT from the orbiter timing 
buffer. The GMT is formatted and inserted in the 
vertical retrace interval by the VSU, using sync 
timing from the RCU ав а reference. This GMT 18 
inserted in all incoming video lines when the VSU 
is in the sync mode. Since both camcorders and 
VTRs are asynchronous devices (i.e., not in sync 
with the RCU), the VSU fails to insert the GMT 
timetag in the correct location of the 
asynchronous video. Crews and flight controllers 
will see this as a thin, flashing, segmented white 
line that scrolls across the screen of the color 
monitors and in the downlink video. The VSU 
interprets the GMT as an elevated camera 
temperature. This will produce a false SM S76 
COMM CAM TEMP message. An asynchronous 
(async) mode command is available to inhibit 
GMT timetags and disable the VSU's temperature 
sensing circuits. The async mode affects camera 
mode sensing in the VSU. The ALC and Gamma 
pushbuttons on panel A7U may remain static and 
not reflect the true configuration of standard 
orbiter payload bay cameras. This async mode is 
usually enabled for VTR playback to downlink 
and for  downlinking camcorder video. 
Otherwise, a white line will be visible in the scene. 


The asynchronous mode does not mean that the 
CCTV System is no longer synced together. 
CCTV cameras are still slaved to the RCU, as is 
the VSU. Since almost all payload customers 
require a GMT timetag in recorded and real-time 
video, crews апа flight controllers must 
coordinate the use of async mode. 
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Video Processing Unit 


The VPU first flew on STS-92 in October 2000. 
The VPU provides two video signals from the 
orbiter CCTV system to the International Space 
Station (ISS) and provides one video signal 
from the ISS to the orbiter CCTV system. The 
VPU also provides the capability to patch one of 
six video inputs to the CCTV PL2 video input of 
the VSU. A subcomponent of the VPU is the 
wireless video system (WVS) interface box 
(WIB). The WIB provides the in-cabin 
communication link to the WVS system. WVS 
is a wireless extravehicular activity (EVA) 
helmet camera system controlled by a laptop in 
the crew cabin and can provide a single video 
signal into the TV system via the PL3 VSU input 
and a view from each helmet to a Sony V10 for 
viewing and recording. Each EVA helmet can 
provide a single view from one of three 
available lenses. Commands to the helmet are 
transmitted via one ultrahigh frequency (UHF) 
antenna, while video returns via one of seven 
S-band antennas in the payload bay. The VPU 
is located on panel R12 and is powered by a 
circuit breaker located on MN B R14 Row D. 
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Digital Television 


The DTV system first flew on STS-110 in April 
2002. The DTV system provides the shuttle 
with the capability to downlink a video signal 
in a digital format. It takes any analog NTSC 
formatted video signal from the CCTV system, 
converts it to a digital signal, and records 
and/or downlinks it to MCC via the Ku-band 
channel 3 PAYLOAD MAX channel. The 
system hardware is located in L10L and consists 
of three main components: the vertical interval 
processor (VIP), a Sony DSR-25 VTR, and a 
multiplexer (mux). 


The VIP is AC powered from AC2 PAYLOAD 3 
Phase. It conditions the video, audio and 
vertical interval for processing by the DSR-25 
VTR. 


The Sony DSR-25 VTR takes the signals from 
the VIP, converts it to digital, and passes it to 
the mux. It provides up to 3 hours of video 
recording and is DC powered from the mux. 


The mux organizes the data for processing by 
the Ku-band system. It receives its DC power 
from the PAYLOAD AUX bus and provides 
power for the VTR and can directly power a 
camcorder. MCC only has insight to the status 
of the DTV mux when the mux is on and a Ku- 
band link is established. INCO will configure 
the Ku-band system between a digital downlink 
(channel 3 PL MAX) and an analog downlink 
(channel 3 TV). 
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Sequential Still Video (SSV) 


The SSV system provides MCC with the 
capability to view a video signal from the 
shuttle without having to rely on Ku-band 
signal coverage. It utilizes the S-band PM 
system, which has more coverage than the Ku- 
band system. Unfortunately, it can only 
provide a snapshot of the video signal that is 
refreshed periodically. This refresh rate is 
dependent upon a sample rate and the available 
downlink rate through the shuttle S-band data 
system, but is typically every 10 seconds. 


For the SSV to work, the crew must configure a 
compression encoder box and cables in the crew 
cabin. The encoder digitizes the video signal to 
be downlinked to MCC as data instead of video. 
Once configured, INCO has the only control of 
the signal being routed to the encoder box from 
the VSU SPARE 1 video output, which is not 
available to the crew on panel A7U. 
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CCTV Camera Lens Control 


The CTVC and IIVC cameras are normally 
operated in an ALC mode; the three ALC settings 
are peak, normal, and average. To select an ALC 
mode, the crew will use panel A7U MENU and 
MODE pushbuttons. MCC/INCO can also select 
АГС settings via uplink commands. Тһе peak 
ALC setting is most sensitive to incoming light; 
therefore, the iris will allow less light to enter the 
lens than with ап ALC setting of normal. The 
average ALC setting will command the iris to 
open more and increase the voltage gain when 
compared to the ALC setting of normal. 


Each ССТУ camera type uses the same switches 
and command sequences to adjust the field-of- 
view of the camera. Just above the six MENU/ 
MODE РВБ is a row of switches used to send 
commands to the cameras and PTUs. 


Lens commands are used to adjust the lens and 
iris settings. The focus, zoom, and iris 
commands provide the crew and MCC with 
direct control of lens settings. The CTVC and 
IIVC insert lens data into the video. The color 
monitors are able to display the lens data in the 
upper portion of the monitor's display. This data 
is also available to INCO in the MCC. In 
addition to changing the field-of-view, the zoom 
function can affect the apparent scene brightness 
when the camera is in ап ALC mode. As bright 
objects increase or decrease in size, the ALC 
adjusts accordingly to increase or decrease the 
amount of light entering the lens. Тһе IRIS 
switch provides manual control of the iris to the 
user. Use of this switch or an iris open/close 
command by MCC disables ALC. When using 
this switch, crews must not leave the payload bay 
cameras unattended. 


NOTE 
Direct sunlight сап permanently damage these 
cameras if a camera iris remains open. 
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Pan/Tilt Units 


The PTUs are used with cameras A, B, C, D, and 
the RMS elbow. The PTUs are used to change 
the camera field-of-view by moving a camera 
about two axes. The PTUs can pan and tilt 170° 
in either direction, positive or negative, when 
any CCTV camera is attached. 


The PAN/TILT RESET/HIGH RATE/LOW 
RATE switch on panel A7U is used to configure 
the rate of movement for the PTU of the camera 
selected. The RESET position is momentary and 
resets the camera's pan/ tilt coordinates to zero. 
The HIGH RATE position allows the PTU to 
pan and tilt at a rate of 12° per second. The 
LOW RATE position allows the PTU to be 
commanded at a rate of 1.2° per second. The 
TILT UP/DOWN and РАМ LEFT/RIGHT 
momentary switches are used to initiate and 
maintain movement about the tilt and pan axis 
until the switches are released or a hardstop is 
encountered. Pan and tilt commands can be 
executed simultaneously. The PTUs may 
encounter clutch slippage during operation, 
particularly when configured for high rate. 
When the clutch slips, there is a temporary 
suspension in PTU movement. The camera will 
continue counting during this period because 
there is no feedback from the PTUs to the 
camera to suspend counting. This affects the 
accuracy of camera pointing in support of 
payload activities. 


Pan/Tilt Unit and Camera 
with Thermal Blankets 
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MCC is capable of configuring the pan/ tilt rate 
to be different from what the crew has set. For 
uplinked commands, the rate defaults to high 
during CCTV activation. INCOs usually use 
the low rate for more effective management of 
CCTV camera movement because of the time 
delays in the orbiter's communications systems. 


Cabin Cameras 


Although all CCTV cameras are compatible 
with the TV outlets located on panels O19 and 
MOSSF, there are no plans to regularly use 
these cameras in the flight deck or middeck 
areas. Camcorders have replaced the CCTVs in 
the orbiter crew compartment. In addition to 
providing excellent real-time video, the 
camcorders can also record and play back video 
without using an external video recorder. The 
current main cabin camera is the Sony PD100 
camcorder. Another cabin camera that is used 
in the shuttle is called the minicam. Unlike the 
camcorder, it only produces a video signal. 
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Sony PD100 Camcorder 


The Sony PD100 digital camcorder is a 
commercial off-the-shelf (COTS) device that can 
be used in one of three ways. It can be used 
either as a camcorder to record video captured 
by its integrated lens, a video camera that can 
send a video signal into the orbiter TV system, 
or a VIR that can record and playback video 
with audio if needed. It processes video with 
three CCDs, one for each color. It has a wide 
conversion lens that can be attached to the 
integrated lens to widen its field-of-view. It has 
an integrated 3.5-inch liquid crystal display 
(LCD) monitor that can be used to view live 
camera video or playback VTR video. It uses a 
40-minute digital DVCAM format tape for its 
video recording / playback operations. 


The PD100 can operate from either orbiter power 
via an advanced video interface unit (AVIU), 
from the DTV MUX, by battery power or by a 
camcorder power interface (CCPI) unit. The 
AVIU must be connected to either of the TV 
ports. The battery is a Canon camcorder battery, 
which requires an adapter to allow it to be used 
on the Sony camcorder. The battery lasts from 40 
to 60 minutes depending on how the camcorder 
is used. This same adapter is required to power 
the camcorder from an AVIU. No adapter is 
required when powered from the DTV MUX. 
The CCPI can be connected to either a TV port or 
from an orbiter DC power port. The CCPI can 
power up to two camcorders along with one 
compact portable light (CPL). The CCPI can only 
supply power, not transform return video. The 
CCPI and CPL are rarely used. 


The PD100 can record, playback or generate live 
video in either analog or digital formats. Live 
analog video from the camcorder must go 
through the AVIU to be converted from 
unbalanced to balanced video. It is then routed 
into either of the TV ports. Live digital video 
from the camcorder can go directly into the 
DTV MUX with a single cable. Video from a 
connector on the back of the color monitors can 
be sent to the camcorder to be recorded. The 
AVIU is required to convert the balanced 
output video of the monitor to an unbalanced 
signal usable by the camcorder. The vertical 
interval (VI) data that is imbedded in this video 
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cannot be recorded Бу the camcorder. An audio 
terminal unit (ATU) recorder cable is required 
to interface with the orbiter audio system to 
record and playback analog audio. Although 
the camcorder can record and playback stereo 
audio signals, the orbiter audio system is not 
capable of transmitting or receiving stereo (one 
audio channel only). 
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Advanced Video Interface Unit (AVIU) 
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Мілісат 


Тһе minicam is a small Sony ХС-999 single- 
CCD video camera that can route NTSC video 
into either of the orbiter TV ports. It requires an 
AVIU for power and video conversion. The 
four lenses that screw into the camera body are 
a fish-eye 3.5mm lens, a normal 6mm lens, and 
two telephoto lenses (12mm and 23mm). Since 
it is just a camera, it requires an LCD monitor to 
view the video and some kind of VTR to record 
the video. The minicam is used for ascent and 


entry video and is sometimes used during the 
on-orbit phase of flight as another in-cabin 
camera in addition to the camcorder. Minicam 
video can be configured to be a synchronous video 
source or an asynchronous video source per AVIU 
switch configuration. 


Minicam body 
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Minicam lenses 
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VTRs 


Even though the PD100 camcorder can be used 
as a VTR, it normally is not used in that manner 
on orbit. This task is left to one of two VTRs in 
the crew cabin: a small, portable Sony V10 VTR 
and the DTV VTR (Sony DSR-25) that is an 
integrated part of the DTV system. Both are 
digital recorders that are in the same family as 
the PD100 camcorder so all of the video 
recorders work well with each other and share 
the same tape types/ formats. 


Sony V10 VTR 


The Sony V10 digital УТК is a COTS video 
recorder/player that can be used in-cabin for 
various tasks. It is powered just like the Sony 
PD100 camcorder and can record video through 
an AVIU just like the camcorder. It has ап 
integrated 5.5-inch LCD monitor that can be 
used to monitor video being sent to the VTR or 
for viewing playback video. It uses the same 
40-minute DVCAM digital tapes that the 
camcorder uses. It can also record and play 
back orbiter audio just like the camcorder. Like 
the PD100, the V10 can record and/or play back 
analog or digital video and audio. Also like the 
PD100, the V10 cannot record VI data that is 
imbedded in the orbiter analog video. This 


means that information like payload bay 
camera settings and GMT time will not be 
recorded. The only way to record this data is 
with the DTV VTR. 
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The DTV VTR is an integrated part of the DTV 
system. The DSR-25 replaced the DSR-20 after 
tape jamming failures were discovered on STS-107 
and STS-114 that were specific to the DSR-20. The 
DSR-25 first flew оп STS-115 as the official 
replacement in September of 2006. It is installed in 
a bucket at L10L along with the VIP. It is a digital 
VTR that performs the  analog-to-digital 
conversion for the DTV system. It provides a 
built-in, long-duration video recording and 
playback capability for the crew. It can use 
either the 40-minute DVCAM digital tapes that 
the PD100 and V10 use or а 3-hour DVCAM 
digital tape without any special adapters. 
Unlike the other units, it can record the VI data 
that the VIP strips from the orbiter video signal. 
It records this data on its audio channel 2. 
Orbiter audio can be recorded on its audio 
channel 1 via the direct link to the VIP and a 
cable connected to a crew communications 
umbilical (CCU). Playback video/audio/VI 
data from the DSR-25 is designed to be sent to 
MCC via the digital downlink route. It can be 
configured to downlink video and audio 
through the analog downlink route in an 
alternate configuration. The DSR-25 does have 
an integrated monitor to view live or playback 
video. The crew can also route a video 
monitoring signal to either one of the CCTV 
monitors (nominal), a V10 VTR, or a battery 
operated LCD monitor. 


SON Vg 
11 


Sony DSR-25 VIR 
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Monitors 


The CCTV system uses a variety of monitors to 
display video. Two color television monitors 
located on panel A3 are always flown. The color 
monitors replaced B&W monitors that had been 
flown since the beginning of the SSP. Portable 
LCD monitors are flown to display camcorder 
and VTR video without having to use either 
CCTV color monitor. 


Ф Ф Ф ө есе 
~ А 3 EAER 
и № 5 
a 
| Ф» Ə 5 Ф) 
М Л CONTRAST A 
@ @ асман 
i 
M » 
Color Television Monitor (СТУМ) 


CCTV Color Monitor 


The CTVMs are the primary display equipment 
of the CCTV system. These 10-inch monitors 
display NTSC and FSC color. Rotary knobs are 
used to control the contrast, brightness, color, 
and tint of the video displayed. The color and 
tint are only effective displaying NTSC video; 
they are not effective with FSC video. 


Each monitor uses a graphical menu for 
configuration control. Тһе menu can be 
displayed by activating either the FUNCTION or 
SELECT controls. The menu will be displayed 
for 12 seconds after the last command 
(FUNCTION or SELECT) is executed. The 
FUNCTION switch is used to move through 
different menu headings. Тһе SELECT 
pushbutton allows the user to toggle between 
different options within each menu heading. 


The menu can be used to enable viewing of 
CTVC/ITVC lens data, CCTV camera data, and 
crosshairs. Data and crosshairs that appear 
green are characters generated within the color 
monitor and can be activated by selecting GRN 
for camera data and crosshairs by turning on 
lens data. White characters are generated 
within the VSU and can be displayed by 
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selecting WHT for camera data and crosshairs. 
Lens data will display zoom, focus, and iris 
settings of the CTVC and ITVC cameras. These 
fields are static when a video source other than 
a CIVC or ITVC is displayed. Lens data, when 
activated, will appear at the top of the screen. 
The camera data will display camera ID, pan 
and tilt angles, and temperature, although the 
white data displays temperature of the camera 
only when the VSU detects a camera with an 
elevated temperature. Camera data is 
displayed in the lower portion of the screen. 


Each color monitor can select from one of five 
independent video sources. PNL will display 
any video routed to the monitor using panel 
A7U. Тһе DNLNK will allow the user to view 
any video selected for downlink. The C and D 
selections will view video from equipment 
connected to the C IN or D IN connectors on the 
front of the monitor. RGB will allow the user to 
view video that directly drives the red, green, 
and blue electron guns of the monitor (such as 
МТ5С component) The RGB connector is 
located on the rear panel of the monitor. SPLT 
is another source available and provides a split 
screen image of C and D inputs. 


There are two ground checkout menu functions 
on the lower left portion of the menu (PULSE-X 
ON/OFF and GUNS R G B). USCAN ON/OFF 
enables or disables the underscanning feature. 
When ON, the underscan allows viewing of 
edge-to-edge video (horizontal and vertical) 
with no loss of image data; i.e., you see what the 
camera sees. When USCAN is OFF, about 5 
percent of each horizontal and vertical edge is 
lost. In addition, the top line of the upper menu 
and the bottom line of the lower menu cannot 
be seen when USCAN is OFF. The FSC function 
selects between 6FLD (6 field) and 3FLD (3 
field). This feature determines how often FSC 
color is updated to the screen. 6FLD is the 
default and preferred setting, except for 
viewing FSC video of objects in rapid motion. 
This function only applies to cameras with 
wide-angle lens assembly (WLA) or color lens 
assembly (CLA) lenses. The DEGAUSS 
function dissipates magnetic fields that build up 
around the monitor as the orbiter moves at high 
speed through the Earth's magnetic field, but 
only when DEGAUSS is in the default AUTO 


position. AUTO engages the degaussing 
circuitry every 90 seconds. OFF disables this 
feature. 


The SYNC function of the monitor displays the 
source of sync used to display video and 
graphics (menu and green data) When no 
video is detected by the monitor, the field under 
SYNC will indicate EXT for external source. 
This means that the sync line from the RCU to 
the monitor is providing the sync pulses 
necessary to display the menu and data. This field 
can be useful for quick troubleshooting for loss of 
video (camera power fail vs. iris stuck closed). 
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CCTV color monitor with menu and L-Data 


Video format can be selected manually or 
automatically. Тһе CIVMs default to AUTO 
MODE in which the monitor determines the 
video format from data embedded in the CCTV 
camera video. CTVCs will use the NTSC format, 
and ITVCs will use B&W decoding. Camcorders 
do not provide this data; hence the monitors will 
process the camcorder video using the default 
NTSC converter. The crew can override the 
AUTO selected format by taking MODE to MAN 
and then toggling the FRMT to select NTSC, FSC, 
or B&W. If a mux scene is routed to a monitor, 
the monitor will select FSC because of the nature 
of the video processing by the VSU in creating 
the mux scene. In order to display NTSC color 
from a СТУС in a тих scene, the user must 
manually override the format and select NTSC. 


The CTVMs have a connector labeled J3 on the 
rear of the monitor. This connector provides a 
balanced video signal of whatever video is 
routed to the monitor output pushbutton on 
panel A7U. A VTR or a camcorder can record 


this video. Any VSU (white) data requested by 
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the monitor will be recorded by the camcorder. 
Monitor (green) data will not be recorded. 


LCD Monitor 


The LCD monitor is a battery operated monitor 
that can be used with any analog video device 
to display video. Typical uses are with a 
camera such as the minicam or with the DTV 
VTR for playback or live video such as entry 
video. It takes six AA batteries that are placed 
in a separable battery compartment with all of 
the batteries arranged in the same orientation. 
It will only appear to work when video is 
actually flowing into the device and it will drain 
batteries at a relatively rapid rate. Therefore, it 
is not used very often. 


COLOR LCD DISPLAY (w/batts) 


SED39123751-303 


LCD Monitor 
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TV Cue Card 


The TV cue card includes activation procedures 
for the CCTV system and payload bay cameras. 
This cue card also includes steps that can 
command the cameras to different operating 
modes. The steps indicated are good guidelines 
for setting up cameras in a safe (ALC active) 
configuration. | However, crews should not 
hesitate to command cameras out of their normal 
operating modes. Since lighting conditions on 
orbit are quite dynamic, ALC modes, manual 
gain modes, and gamma settings may require 
changes. Crews should take the initiative and 
adjust the cameras to provide the best possible 
video of the object(s) in view. CCTV camera 
operation is more of an art than a science when it 
comes to getting acceptable looking video. 
However, please note the caution block, as the 
CCIV cameras are susceptible to damage by 
direct sunlight while in a manual mode. 
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ACTIVATION HOOK 
АЗ MON 1(2) PWR-ON (LED ОМ) 
AT YTV ОМСК - ЕМА 


PWR СМТ – PNL 
CONTR UNIT - ММА(В} 
СМТЕ – СМО (wat 10 sec for system initialization) 


OPERATION 
Auto Ops (Auto Exposure) 


NOTE 
УМСС has commanded sync config 


AT TV САМЕ PWR А(В,С,О,ВМ5)- ON (tb-ON) 
VID OUT MON 1(2) pb - push 
IN pb - As reqa 
If CTVC: 
ALC pb – push 
AVG pb – push 
If ITVC: 
Ҥ MAN GAIN pb not illuminated: 
TV САМА PWR A(B,C,D.RMS) – OFF, wait 10 sec, then ОМ 
Repeat until MAN GAIN pb illuminated 
LT LEVEL pb - push 
DAY(NIGHT] pb – push 
ALC pb - push 
AVG pb – push 
Repeat for other Camrs as reqd 


Опік Ops 


Coordinate dnik and sync config w/MCC 
Config audio as reqd 


If analog, on MCC GO: 


AT VID OUT ОМК pb – push 
IN pb – As read 
If DTV. оп МСС GO: 
L10 *Cables connected 
(MUX) MUX/VTR/CC PWR - сп (LED on) 
{МОХ BYPASS - ACT 
(VIP) PWR – on (LED on, DATA FLOW LED flashes twice) 
(VTR) *ON/STANDBY LED - green 
*INPUT SELECT - VIDEO 
AT VID OUT DTV pb - push 
IN pb – Аз read 
110 ; 
(МІР) NDATA FLOW LED – on 
(MUX) NCHANNEL 3 DATA LED - on 
DEACTIVATION 


If Illuminator ON: 
Refer to Illuminator Ops and perform Illuminator OFF 


АТ PORT RMS CAMR - WRIST 
ТУ САМЕ PWR A(B,C,D.RMS) – OFF (tb-OFF). wait 10 sec 
PORT RMS CAMR - ELBOW 
TV САМЕ PWR RMS – ON (tb-on), wait 10 sec, OFF (Њ-ОРЕ) 


TV PWR CNTL – PNL 
CONTR UNIT - OFF 


CNTL-CMD 
A3 MON 1,2 PWR – OFF 
ОТУ: 
L10 
(VTR) ON/STANDBY pb – push (red LED on) 
(МР) PWR – off (LED off) 
(MUX) MUX/VTR/CC PWR – off (LED off) 


VTRICC PWR - off (LED off) 
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VELCRO 


Manual Ops - СТУСЛТУС (Manual Exposure) 


CAUTION 
DO NOT LEAVE CAMRS UNATTENDED 


IN MANUAL MODE. DIRECT SUNLIGHT 
WILL DAMAGE CAMRS 


Manual Exposure ON 

AT MAN GAIN pb – push 
0{+12.+24) dB pb – push 
CAMR СМО IRIS – OP.CL 


Return to Auto Exposure 
ALC pb – push 
AVG pb – push 


MUX Ops 


NOTE 
Although dnik/rcd is in color, MON 
will display MUX in B&W 


AT VID OUT MON pb – as read 
IN MUX 1(2) pb - push 
OUT MUX 1(2) L pb – push 
IN pb — As read 
OUT MUX 1(2) R pb – push 
IN pb — As геда 


For RSC ops: 
Go to ШОВИЛТУС Cue Card 


Р/ТУ-1а/120/О/А 


ТУ Cue Card From Photo/TV Checklist (Front) 
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HOOK 
VELCRO 


Шитіпайог Ops 
iiuminator ON 
If Wrist luminator: 
К14:0(Е) «cb TV RMS CAMR/PTU - с 
VWRIST ILLUM/CAMR HTR - cl 
- op, then cl 
lf Elbow Illuminator 
усо TV RMS CAMR/PTU - d 
ЧЕТВ ILLUM/PTU HTR - с! 
- op. then cl 
If A(B.C,D.ELB) illuminator: 
Ус TV A(B,C.D.RMS,ELB) CAMR/PTU ~ с! 
VILLUM/PTU НТВ ~ cl 
- op. then cl 
llluminator OFF 


If Wrist luminator: 
cb TV RMS WRIST ILLUM/CAMR HTR - op. then с! 


R14D(E) | 
If Elbow Illuminator: 
cb TV RMS ELB ILLUM/PTU HTR - op, then cl 


| 
If A(B.C,D.ELB) Illuminator: 
cb TV A(B,C,D,RMS,ELB) ILLUM/PTU HTR ~ op, then сі 


If RSC Illuminator: 
Go to LDRUITVC (Cue Card) 


OBSS 
LDRIITVC 


LCS/IDC 


FWD 


с 


(СТУС м/180 
White Illuminator) 


8 
(ІТУС w/180 
White Illuminator) 


9^ n 
RSC \ | 
ИШ 


(VIDEOSPEC 
м/НІ, MED, LOW 11 
0 


White Illuminator) 
1 


| 
1 
1 


" 


ODS 


WRIST 
(CTVC м/40 
White Illuminator) 


| 
0 


| | &sow 
| | (СТУС wnan 
| | White Illuminator) 


15048237. 120-214 ух 


CENTERLINE | 
(СТУС) | | 
| | 
| | 
| 
| | 
| 
| 
р А 
(CTVC м//180 (CTVC w180 
White Illuminator) 


White Illuminator) 


TV Cue Card From Photo/TV Checklist (Back) 


2.3-18 


P/TV-1b/120/O/A 


2. SYSTEMS 


2.3 CLOSED CIRCUIT TELEVISION (CCTV) 


OBSS on Starboard Sill 


Orbiter Boom Sensor System (OBSS) 


The OBSS first flew on STS-114 in July 2005. The 
OBSS consists of a 50-foot boom stowed on the 
starboard sill with two sensor packages on the aft 
end of the boom. The main goal of the OBSS is to 
provide on-orbit inspection video and data of the 
orbiter thermal protection system (TPS) to determine 
if the orbiter can safely return to Earth or if it needs 
repair before coming home. The OBSS is grappled 
by the shuttle remote manipulator system (SRMS) 
and moved around by the crew to position the sensor 
packages to take the inspection video and data for 
further MCC processing. Тһе orbiter Ku-band 
system provides the downlink to MCC of the sensor 
packages video and data. The OBSS has two 
different sensor packages, each with pros and cons. 
By having two different sensor packages there is not 
a single or common failure point to take out both 
sensor assemblies. Also by having two different 
sensor packages, it provides MCC with more tools to 
complete inspection objectives. 


ITVC/Laser Dynamic Range Imager (LDRI) 


The first sensor package (5Р1) is the ITVC/LDRI 
system. The big picture of the system is that the 
ITVC provides 2-dimensional (2-D) NTSC black and 
white images of the TPS surfaces and the LDRI 
provides 3-D information of the orbiter TPS 
surfaces. Both the LDRI video and the boom ITVC 
video are considered synchronous sources to the 
CCTV system. The ITVC/LDRI video is sent to the 
VPU MISS CAM port, labeled LDRI/ITVC with a 
crew preference decal, and is viewable by selecting 
the PL2 input. The orbiter DTV system is used to 
downlink the video and data. The video and data can 
be sent to MCC via the orbiter analog TV path in 
case of a DTV failure, but DTV is preferred because 
the video image is not degraded like the transmission 
of the analog video. The ITVC is mounted on a 
pan/tilt unit with the LDRI mounted on the bottom 
of the ITVC, so both the LDRI and ITVC are using 
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the same pan/tilt unit. LDRI video and ITVC video 
cannot be viewed simultaneously. Тһе laser is 
infrared (IR) at 805 n. mi. and not visible to the 
human eye. The LDRI camera is sensitive to IR and 
produces NTSC black and white video. The LDRI 
camera is similar to the ITVC video in that they are 
both NTSC black and white 2-D video with similar 
resolution when there is no laser modulation. When 
there is laser modulation, the LDRI video appears to 
flicker and when the data is processed at MCC, it 
provides length, width, and depth of the scanned 
area. The crew can manually put the LDRI in six 
different modes of operation per the panel A7 PBIs. 
The ГОКИТУС Cue Card in Ше Рһою/ТУ 


Checklist has the steps for activation, general LDRI 
control, and deactivation. The PDRS СЛ, directs the 
crew when to go to different LDRI modes and when 
to start and stop recording. 


Aft End of OBSS 
Laser Camera System (LCS) 


The second sensor package (SP2) is the LCS. The 
LCS consists of the laser camera head (LCH), a crew 
cabin payload general support computer (PGSC) 
called the laser camera controller (LCC), a black and 
white integrated sensor inspection system digital 
camera (IDC), and a lab at JSC for ground 
processing. The LCS operates at around 1500 n. mi. 
and produces detailed 3-D images of the scanned 
area. The LCS output is a binary data file stored on 
the ГСС PGSC and downlinked to МСС via the 
normal orbiter communication adapter (OCA) 
methods through the orbiter Ku-band system. The 
LCS does not have a pan/tilt unit and must rely on 
the position of the boom. Activation, operation, and 
deactivation of the system are found on the LCS Cue 
Card in the Р/ТУ СЛ. The IDC is used for a 
secondary view to obtain still images of the damaged 
area after the primary scan is complete. 
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OBSS Modes of Operation 


The crew or MCC can command the LDRI into 
six different modes of operation. Mode 1 has 
the LDRI in a standby mode and is the default 
mode upon activation. Mode 2 cycles the LDRI 
laser on and off to act as an illuminator for the 
ITVC. The human eye cannot see the laser, but 
the electronics in the ITVC are sensitive enough 
to pick up the IR and it make the scene look 
brighter. In both modes 1 and 2, only ITVC 
video can be seen. The LDRI camera video can 
only be seen in modes 3 through 6. Mode 3 is a 
2-D mode with the LDRI camera on, gamma 
black stretch off, and the laser cycling on and 
off but no modulation or phase shift, which 
means no 3-D data and the scene is not 
flickering as it does in modes 5 and 6. Mode 4 
is the same as mode 3 but with gamma black 
stretch on, so the darker regions of the scene are 
brighter. Mode 5 is a 3-D mode with the LDRI 
camera on, gamma black stretch off, and the 
laser cycling on and off with modulation and 
phase shift to provide 3-D data. The LDRI 
scene appears to flicker in this mode. Mode 6 is 
the same as mode 5 but with gamma black 
stretch on, so the darker regions of the scene are 
brighter. 


The LDRI was designed to recognize commands 
when a certain sequence of buttons is pushed. 
For the crew to command to the LDRI, the 
procedures in the LDRI/ITVC Cue Card in the 
Photo/TV Checklist have them push the 
MUX1L output PBI, then the MIDDECK PBI, 
and then one of the six MENU ог MODE PBIs. 
Going from left to right on the MENU and 
MODE PBIs are the six ГРЕГ modes. The left 
most MENU PBI is LDRI mode 1 and LDRI 
mode 6 is the right most MODE PBI. When the 
crew is commanding the ІЛКІ, there is no 
feedback on the MENU or MODE РВ to let 
them know what mode they are in, meaning the 
MENU or МОРЕ PBIs will not light up when а 
LDRI mode is commanded. The LDRI mode 
telemetry is in the LDRI video, which is coming 
through the CCTV system via the PL2 input. 
The crew will only see what LDRI mode they 
are in on the MENU or MODE PBls when they 
push the output PBI that is assigned to РІ2 
input and LDRI video is being routed (which 
are modes 3 through 6). In modes 1 and 2 the 
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MENU and MODE PBIs would show the ITVC 
settings such as ALC AVG. When the crew has 
the MUXIL and the MIDDECK PBIs pushed, 
the only commands to the LDRI are the six 
different modes and the iris open or close 
commands via the IRIS switch, which provides 
gain control for the LDRI in mode 3 through 6 
to make the scene look brighter or darker. 
When viewing the LDRI video on the monitor 
and L-Data is on, the monitor shows T stop 
values between 70 and 280. Default is 280, 
which is the darkest and 70 is the brightest. If 
the gain is changed from the default while in 
modes 3 through 6, the gain will remain 
unchanged when switching to other modes, 
except when going back to mode 1, where it will 
default back to 280. There are times when the 
crew will be commanding the boom ITVC in the 
blind when the LDRI is in modes 3 through 6 and 
the video output PBI is pushed that is assigned to 
the PL2 input PBI. In this scenario, the crew is 
viewing LDRI video but any MENU or MODE 
PBIs pushed or IRIS switch changes are going to 
the ITVC in the blind because the crew cannot see 
the changes since they are viewing the LDRI 
video. Ш pan or tilt adjustments are made, the 
crew would see the pan and tilt numbers change 
on the monitor with even though LDRI video is 
displayed because the LDRI is attached to the 
bottom of the ITVC and the pan and tilt data is in 
the LDRI video as well. To prevent the ITVC 
from being commanded to an unwanted mode 
and possibly incurring damage, it is 
recommended pan and tilt adjustments be made 
when in the ITVC viewing mode. Тһе 
LDRI/ITVC pan range is +9.8° to -170?. The tilt 
range is *175? to -125°. 


There are three different modes of operation for 
the LCS: quickview, detailed scan, and line scan. 
The quickview is used so the crew can visually 
verify in 10 to 30 seconds the scene has the 
correct field of view by seeing a low resolution 
scanned image. The detailed scan produces a 
high resolution 3-D image. Тһе ground 
processes the data to produce the 3-D models. 
The scan is in a rectangular pattern and is used 
for stop and stare operations. The line scan is 
used when the RMS is providing continuous 
motion and it is scanning in one direction. This 
mode produces 3-D images but can also be used 
to supplement 2-D images. 
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CCTV System Summary 


® The CCTV system is used on orbit to support 


payload and orbiter activities by using real- 
time and recorded video. 


The CCTV system is composed of CCTV 
cameras, pan/tilt units, color monitors, 
camcorders, video tape recorders, video 
processing equipment, and accessories. 


All CCTV functions can be controlled by the 
crew. Most CCTV functions can ђе 
configured by MCC via uplink commands. 
Both crew and MCC can command all CCTV 
camera functions. 


CCTV equipment is powered from circuit 
breakers located on panel R14. 


Crews use panel A7U to control the CCTV 
system. 


The video control unit is the heart of the 
CCTV system and is the central processor. 
The VCU is composed of the remote control 
unit and the video switching unit. 


The CTVC provides NTSC color video. In 
addition to CCTV camera data, CTVCs also 
provide lens data. 


The ITVC generates black and white video. 
This CCTV camera is designed to operate in 
a low-light environment. 


Two 10-inch color monitors display video 
onboard. The monitors are located on panel 
A3 and provide connectors for VIRs to use 
for recording. The monitors are configured 
via a display menu system. 
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Description 


The orbiter communication system transfers the 
following types of information: 


e Telemetry information to the ground 
about orbiter operating conditions and 
configurations, systems, and payloads 


• Commands from the ground to the 
orbiter systems to perform a function or 
configuration change 


® Documentation from the ground that is 
printed out through an orbiter comm- 
unications adapter апа laptop 
networked printer 


e Voice communications among the flight 
crew members and between the flight 
crew and ground, ISS, and EMU 


This information is transferred through 
hardline and radio frequency (RF) links. 
Hardline refers to wires that connect 


communicating devices, and RF refers to radio 
signals. RF communication takes place directly 
with the ground sites or through a tracking and 
data relay satellite (TDRS). 


Direct communication for NASA missions takes 
place through space flight tracking and data 
network (STDN) ground stations. For military 
missions, Air Force Satellite Control Facility 
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the ground to the orbiter are referred to as 
uplinks (UL), and signals from the orbiter to the 
ground are called downlinks (DL). 


TDRS communication takes place through the 
White Sands Ground Terminal (WSGT) and 
Second TDRS Ground Terminal (STGT). These 
indirect signals from the TDRS to the orbiter are 
referred to as forward links (FL), and the signal 
from the orbiter to the TDRS is called the return 
link (RL). Communication with a detached 
payload from the orbiter is also referred to as 
forward link, and return link is the signal from 
the payload to the orbiter. 


The orbiter communication system is divided 
into several smaller systems: S-band phase 
modulation (PM), S-band frequency 
modulation (FM), Ku-band, ultrahigh frequency 
(UHF) simplex, space-to-space orbiter radio 
(SSOR), payload communications, audio, and 
closed-circuit television (CCTV). (CCTV is 
discussed separately in Section 2.3.) 


The S-band FM, S-band PM, Ku-band, and UHF 
simplex systems are used to transfer 
information between the orbiter and the 
ground. Тһе SSOR is used to transfer 
information between the orbiter and 155/ ЕМО. 
The payload communication system is used to 
transfer information between the orbiter and its 
payloads through either hardline or RF links. 
The audio system provides analog voice 
between the orbiter comm station and 
MCC/POCC on the ground. The CCTV system 
is used to visually monitor and record activities. 


The ground command interface logic (GCIL), 
also referred to as the ground command 
interface logic controller (GCILC), controls 
selected functions of the S-band PM, S-band 
FM, Ku-band, payload communication, and 
CCTV systems. Each of these communications 
systems has an associated CONTROL switch 
with the positions PANEL and COMMAND. 
When the switch is set to PANEL, the system 
can be accessed by the crew using panel 
switches. When the switch is set to 
COMMAND, control is by ground command 
via GCIL. The locations and operations of these 


(AFSCF) remote tracking station sites, also ^ switches are provided in the individual 
known as space-ground link system (SGLS) communications systems discussions that 
ground stations, are used. Direct signals from | follow. 
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All commands are sent to the orbiter from the 
ground through S-band system uplink or Ku- 
band system forward link and are routed to the 
onboard GPC through the network signal 
processor (NSP) and associated flight forward 
(FF) multiplexor/demultiplexor (MDM). The 
commands to reconfigure the GCIL controlled 
communication systems are routed from the 
GPC through the payload forward (PF) MDMs to 
GCIL. 


FF 1 PF1 
ND) t (3) Ээ» 9a» SH (2) 
MDM MDM 
S-band S-band S-band 
KU-band CCTV 
ЕШ panel || рела || рамы || Panel 
АШ АШ ALR 


| | мл) | | 


Рапе!/ 
соттапа 


Рапе!/ 
соттапа 


Рапе!/ 
соттапа 


Рапе!/ 
соттапа 


Рапе!/ 
соттапа 


S-band S-band KU-band S-band CCTV 
payload payload system FM system 
system system У system У 
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Ground Command Interface Logic 


NOTE 


Because of the large number of distinct 
elements of the Communications system, 
a separate Operations subsection is not 
included. That information is provided 
within the separate element discussions. 


S-Band Phase Modulation 


Ihe S-band PM system provides two-way 
communication between the orbiter and the 
ground, either directly or through a relay 
satellite. It provides communication channels 
for five functions: 


e Command channel: used to send 
commands from ground to orbiter. 


e Voice channel(s): used for two-way 
voice communications between ground 
and orbiter. 
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e Telemetry channel: carries real-time 
orbiter and payload operational 
telemetry data to ground. 


е Turnaround tone ranging channel: used 
to determine slant range from a known 
point to the orbiter. Tones аге 
transmitted from the ground to the 
orbiter where they are "turned around" 
and transmitted back to ground from 
the orbiter on a coherent RF carrier. 
Slant range can be computed from net 
total two-way phase delay of the major 
tone for the "round trip." 


® Two-way Doppler tracking: used to aid 
in tracking the orbiter. An RF carrier, of 
precisely known frequency, is 
transmitted to the orbiter. 


A characteristic of RF signals in the S-band 
range is that "line-of-sight" must exist between 
transmitting and receiving antennas to permit 
communications. With the availability of the 
Tracking Data Relay Satellite System (TDRSS) 
network, communications coverage can be 
about 80 percent, excluding a communications 
gap called the zone of exclusion (ZOE). In the 
ZOE, the orbiter will not be in the line-of-sight 
with either satellite. Geographically, the ZOE is 
over the Indian Ocean region. During critical 
phases, such as orbit docking or OMS-2/ deorbit 
burns, the ZOE can be covered by scheduling a 
TDRS Z satellite, thus providing nearly 100 
percent communication coverage with MCC for 
these orbits. For some missions, vehicle attitude 
constraints imposed by payload experiment or 
station requirements may cause loss of comm 
because line-of-sight is obstructed, causing a 
loss of signal (LOS) or "ratty comm" conditions; 
ie. when TDRS is oriented off the nose or off 
the tail of the orbiter. 


For orbit operations, the TDRSS network 
provides most of the comm relay between the 
orbiter and MCC. The TDRSS network has nine 
satellites supported by the WSGT and SIGT 
facilities. | Typically, the satellites used for 
operational support are located approximately 
130° apart in geosynchronous orbit. Тһе 
satellites are commonly referred to as "east" 
and "west," " A" and "B," or, more correctly, by 
their logitudinal locations, such as -47 and -171. 
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S-Band Forward Link 


The S-band forward link operates through the 
STDN or TDRS. It is phase modulated on a 
center carrier frequency of either 2,106.4 MHz 
(secondary) or 2,041.9 MHz (primary). The two 
frequencies would prevent interference when 
another satellite or payload is in operation at 
the same time and place. One user selects the 
high frequency, and the other selects the low 
frequency. 


The forward link originates from Mission 
Control through the NASA STDN ground 
stations for ascent and entry, or through the 
WSGT/STGT via the TDRS system for orbit 
operations. The high data rate is 72 kilobits per 
second (kbps), consisting of two air-to-ground 
(A/G) voice channels at 32 kbps each and one 
command channel at 8 kbps, two-way Doppler, 
and two-way tone ranging. The low data rate 
of 32 kbps (currently not nominally used) 
consists of one A/G voice channel at 24 kbps 
and one command channel of 8 kbps, two-way 
Doppler, and two-way ranging. The two-way 
ranging does not operate through the TDRS. 


S-Band Return Link 


The S-band return link operates through the 
STDN or TDRS. It is phase modulated on a 
center carrier frequency of 2,2875 MHz 
(secondary) or 2,217.5 MHz (primary). The two 
frequencies prevent interference if two users are 
operating at the same time and place. 


The S-band PM return link can originate from 
one of two redundant S-band PM transponders 
aboard the orbiter. The link transmits the data 
through the NASA STDN ground stations for 
ascent or entry, or through the TDRS via the 
WSGT/STGT to Mission Control for orbit 
operations. 


The high data rate of 192 kbps consists of two 
A/G voice channels at 32 kbps each and one 
telemetry link of 128 kbps, two-way Doppler, 
and two-way ranging. The two-way Doppler 
and two-way ranging are operative only when 
in view of the NASA STDN ground stations at 
ascent or entry. The two-way ranging does not 
operate with the TDRS. 
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The S-band return link low data rate of 96 kbps 
(currently not nominally used) consists of one 
A/G voice channel at 32 kbps and one telemetry 
link at 64 kbps, two-way Doppler, and two-way 
ranging. As noted, the two-way Doppler and 
two-way ranging are used in the same manner 
as in the high-data-rate mode. 


Department of Defense Links 


The Department of Defense (DoD) S-band 
forward link is phase modulated on a center 
carrier frequency of either 1,8318 MHz 
(secondary) or 1,775.5 MHz (primary) from the 
Air Force Satellite Control Facility (AFSCF) 
through its own ground stations (SGLS ground 
stations). 


The DoD S-band return link is phase modulated 
on a center carrier frequency of 2,287.5 MHz 
(secondary) or 2,217.5 MHz (primary) through 
the SGLS mode to the AFSCF ground stations, 
and also does not operate through the TDRS. 
The two S-band return link frequencies also 
would prevent interference if two users were in 
operation at the same time. 


S-Band PM Power Modes 


S-band PM power modes may be selected by 
the crew using the S-BAND PM MODE rotary 
switch on panel A1L. (Usually this is config- 
ured by uplink command from МСС.) 
Selectable modes are SGLS, STDN LO and HI, 
and TDRS DATA and RNG (TDRS RNG is not 
used). In high power modes (TDRS and STDN 
HI), incoming (received) signals from a quad- 
selected antenna are directed through a pre- 
amplifier before reaching the transponder. Out- 
going (transmit) signals are routed through a 
power amplifier and the preamplifier assembly 
diplexer after leaving the transponder en route 
to an antenna. In low power modes (STDN LO 
and SGLS), incoming signals flow from the 
antenna directly to the transponder, and out- 
going signals go directly from the transponder 
to the selected antenna without amplification. 
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S-Band PM Antennas 


Four quadrant S-band PM antennas covered 
with a reusable thermal protection system are 
located approximately 90? apart on the forward 
fuselage outer skin of the orbiter. On the flight 
deck viewed through the forward windows, the 
quadrant antennas are to the upper right, lower 
right, lower left, and upper left. These antennas 
are the radiating elements for transmitting 
the S-band PM return link and for receiving the 
S-band PM forward link. Each quad antenna is 
a dual-beam unit that can "look" forward or aft 
for both transmission and reception without 
any physical movement, effectively creating 
eight antennas for the S-band PM system: LL F 
(lower left forward), LL A (lower left aft), UL F 
(upper left forward), UL A (upper left aft), UR F 
(upper right forward), UR A (upper right aft), 
LR F (lower right forward), and LR A (lower 
right aft). 


These antennas are selected by the antenna 
switch electronics via GPC control, uplink 
command, or manual crew selection using the 
S-BAND PM ANTENNA rotary switch on panel 
C3. When the switch is set to the GPC position, 
antenna selection is nominally automatic by the 
PASS SM or BFS GPC, but can be commanded 
by real-time command from MCC. The antenna 
switching commands are sent to the switch 
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S-Band PM Antenna Locations 


assembly through the PF MDMs. Antenna 
selection is based on the computed line of sight 
to the NASA STDN ground station, the AFSCF 
ground station, or the TDRS in view, depending 
on the orbiter communication mode. Тһе 
current antenna selection and operating antenna 
switch electronics is shown on the OPS 201 
ANTENNA display. Also on the display are 
related items such as the S-band ground station 
in view, TDRS in line of sight, and whether GPC 
antenna selection is enabled or inhibited. 


GPC control can be inhibited to permit ground 
to command an antenna other than the one 
currently selected by the GPC. The ground 
sends a command load to inhibit GPC control 
and a real-time command (RTC) to select the 
desired antenna. GPC control is restored by 
sending a load to enable the GPC mode. The 
crew can perform the same functions by 
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selecting the ANTENNA display, executing 
Item 12 (GPC INH), and then selecting the 
desired antenna by RTC via keyboard. Using 
GPC OVRD (Item 13), the crew can force the 
S-band antenna management software to the 
TDRS mode. An asterisk will be displayed by 
Item 13 while GPC override is in effect. To 
restore GPC control, Item 11 (GPC ENA) is 
executed. 


Other S-band PM fields on the ANTENNA 
display allow prime selection of a TDRS A or B, 
Items 14 and 15, respectively. Designation of a 
TDRS A or B is done by Items 1 through 6.These 
items select the chosen TDRS as prime; if this 
TDRS is not in view, it selects the other TDRS. If 
both are in view, the prime is selected. No 
change is made to TDRS antenna selection if 
neither is in view. Similar logic holds true for 
Ku-band system, Items 9 and 10. 
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Preamplifiers 


Тһе dual S-band preamplifier is used in the 
TDRS and STDN HI modes for amplification. 
In TDRS mode, the preamplifier is required full- 
time for the forward link radio frequency 
because of the much greater distance and, 
consequently, lower strength signal from the 
TDRS to the orbiter geosynchronous orbit 
(minimum of about 22,300 miles) than from the 
STDN to the orbiter (typically, slant ranges are 
in the low hundreds of miles). The preamplifier 
is not used in the SGLS or STDN LO modes. 
One of the two redundant units is used at a 
time, and the output of either unit can be cross- 
strapped to feed either transponder. The 
preamplifier provides an RF gain of about 25 
decibels. 
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S-BAND PM АМТ SW ELEC, PRE AMPL, 
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The PRE AMPL control switches аге on panel 
А11, this function is generally under ground 
command control. If the SBAND PM 
CONTROL switch on panel C3 is set to PANEL, 
preamp 1 or 2 is selected, depending on the 
position of the S-BAND PM PRE AMPL switch 
on panel АП. Тһе COMMUNICATIONS 
display (SPEC 76) under SM OPS 201 shows 
preamp status and frequency configuration 
(PREAMP and FREQ). 


Power Amplifiers 


The S-band power amplifiers provide 
amplification of transponder RF output for 
STDN HI and TDRS operational modes. The 
nominal power gain is about 17 decibels. There 
are two redundant power amplifiers; one is 
used at a time, and the input of either can be 
cross-strapped with the output of either 
transponder. The output of the power 
amplifiers can also be routed through either 
frequency diplexer in the preamp assembly. 


24-7 


USA007587 
Rev. A 


The power amplifiers use a traveling wave tube, 
which has a filament that must be warmed up 
before high voltage is applied to the tube. A 
140-second timer provides the delay when the 
OPERATE mode is selected from a cold start. 
With the system in STANDBY, the filament is 
kept heated, ready for "instant on" operation. 


The PWR AMPL STANDBY and OPERATE 
switches are on panel A1L; these functions are 
generally under ground control. If the S-BAND 
PM CONTROL switch on panel C3 is set to 
PANEL, the switches on panel A1L establish 
power amplifier configuration. 


NOTE 


Both the PWR AMPL STANDBY and 
OPERATE switches should be in the same 
position to avoid a reset of the 140-second 
timer when the backup system is selected. 


The COMMUNICATIONS display, SPEC 76, 
also shows power amplifier status (PWR AMPL: 
OPER, STBY, PWR OUT, and TEMP). 


Transponders 


The S-band PM transponders function as 
multipurpose, multimode transmitter/ 
receivers. The transponder can simultaneously 
transmit and receive, transmit only, or receive 
only. There are two redundant transponders; 
only one transponder operates at one time. The 
selected transponder transfers the forward link 
commands and voice to the network signal 
processor and receives the return link telemetry 
and voice from the network signal processor. 


The transponders may Бе cross-strapped. 
Transponder 1 or 2 may be used with network 
signal processor 1 or 2. The radio frequency 
sections of either transponder can be used with 
either preamplifier and power amplifier 1 or 2. 


The selected transponders provide a coherent 
turnaround of the PM forward link and PM 
return two-way Doppler and two-way tone 
ranging signals. These two-way signals operate 
when the orbiter is in view of a NASA STDN 
ground stations at ascent, entry, or when it is in 
view of SGLS mode ground stations. The two- 
way Doppler operates through the TDRS, but 
the two-way ranging does not. 
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Two-way Doppler is used by ground stations to 
track the orbiter. The S-band PM forward and 
return links are directly proportional to the 
forward link frequency (two-way Doppler). 
The S-band transponder provides a coherent 
turnaround of the forward link carrier 
frequency necessary for the two-way Doppler 
data. By measuring the forward link and using 
return link frequencies expected from the 
orbiter, the ground tracking station can measure 
the double Doppler shift that takes place and 
can calculate the radial velocity (range rate) of 
the orbiter with respect to the ground station. 
Because these links are PM, the S-band carrier 
center frequency is not affected by the 
modulating wave. It would be impossible to 
obtain valid Doppler data of the S-band carrier 
center frequency if it were affected by the 
modulating technique. 


The S-band transponder also provides a 
subcarrier for two-way tone ranging. The 
transponder is used to determine slant range 
from a known point to the orbiter and operates 
only when in view of a NASA STDN ground 
stations during ascent, entry, or in view of SGLS 
mode ground stations. This capability does not 
operate through the TDRS. The ground station 
forward-links ranging tones at 1.7 MHz and 
computes vehicle slant range from the time 
delay in receiving the return link 1.7-MHz tones 
to determine the orbiter's range. The orbiter's 
azimuth is determined from the ground station 
antenna angles. 


The S-BAND PM XPNDR switch is located on 
panel А11; this function is generally handled by 
ground command via the GCIL. If the S-BAND 
PM CONTROL switch on panel C3 is set to 
PANEL, the XPNDR selection is made from 
panel А11. 


The orbit COMMUNICATIONS display, SPEC 
76, gives transponder status (XPNDR and 
MODE). The ОР5 201 ANTENNA display also 
shows the mode for the active transponder. 


Received S-band PM RF signal strength is 
shown on the DC AMPS/SIG STR meter on 
panel F9 when the rotary switch below the 
meter is set to one of six SIGNAL STRENGTH 
positions, and on the SIGNAL STRENGTH 
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indicator on panel A1U when the switch to the 
left of the indicator is set to S-BAND PM. 
Signal strength is also shown on the OPS 201 
ANTENNA DISPLAY (SIG STR). During ascent 
and entry, this display is not available. 


NOTE 


The panel AIU signal strength indication 
comes directly from the operating S-Band 
PM Transponder. Signal strength 
indications on the F9 meter are processed 
first by DSC ОЕЗ before being displayed. 
The OPS 201 ANTENNA display signal 
strength comes from OI MDM OF3 data. 


DCAMPS/SIG STR Meter and Rotary Switch 
on Panel F9 
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Network Signal Processors 


One of two redundant onboard network signal 
processors (NSPs) receive commands (forward 
link) and transmit telemetry data (return link) 
to the selected S-band transponder. The active 
processor receives one or two analog voice 
channels from the onboard audio central control 
unit (ACCU), depending on whether one (in the 
low-data-rate mode) or both (in the high-data- 
rate mode) of the A/G channels are being used. 
Nominally, the HDR mode is used. Both voice 
channels are downlinked only if the NSP is high 
data rate on both forward and return links. It 
converts them to digital voice signals, time- 
division-multiplexes them with the telemetry 
from the pulse code modulation master unit, and 
sends the composite signal to the S-band PM 
transponder for transmission on the return link. 
On the forward S-band PM link, the NSP does 
just the reverse. It receives the composite signal 
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from the S-band transponder and outputs it as 
either one or two analog voice signals to the 
audio central control unit. The composite 
forward link also has ground commands that 
the NSP decodes and sends through the FF 
MDMs (NSP 1 to FF 1 or NSP 2 to FF 3) to the 
onboard computers, which route the commands 
to the intended onboard systems. The NSP data 
routing/ processing modes are controlled by 
command or the NETWORK SIG PROC 
switches on panel A1L. The NSP also routes 
return link (telemetry and voice) and receive 
forward link (commands and voice) via the Ku- 
band system. 


Communications Security 


Communications security (COMSEC) equip- 
ment provides the capability for encryption/ 
decryption of operational data aboard the 
orbiter. The COMSEC equipment works with 
the NSPs to provide selectable transmit, receive, 
and record combinations under NSP mode 
control. 


The NSP routes data of the indicated type 
through the COMSEC encryptor or decryptor as 
appropriate and gets the data back from the 
COMSEC line-replaceable unit encrypted or 
decrypted; if "BYP," the indicated data are 
handled directly by the NSP, and the COMSEC 
is bypassed. 


The three ENCRYPTION switches on panel A1L 
provide power and routing control for 
encrypted data through the NSP. Our current 
operational mode is to use the COMSEC in the 
SELECT/RCV mode - only the uplink (voice 
and commands) is encrypted. 


ALL 
(DOD) 


T/R 
SELECT 
= 
BYPASS 


* Data rate determined by NSP downlink DTA RATE switch. 
** HDR only. 
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Recorded Data Encrypted* 
Transmitted Data Encrypted 
Received Data Encrypted 


Recorded Data Clear (unencrypted) ** 
Transmitted Data Encrypted 
Received Data Encrypted 


Recorded Data Clear (unencrypted) ** 
Transmitted Data Clear (unencrypted) 
Received Data Encrypted 


Recorded Data Clear (unencrypted) ** 
Transmitted Data Clear (unencrypted) 
Received Data Clear (unencrypted) 
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The crew сап perform S-band РМ 
communications system reconfiguration (TDRS, 
STDN HI, STDN LO, or SGLS) by a single item 
entry on BFS GNC OVERRIDE display (SPEC 
51). The COMM status will show LOCK (if NSP 
is locked) and NOLK (if NSP is not locked), 
based on the status from the pulse code modu- 
lation master unit (PCMMU). LOCK will 
depend on the active NSP FRAME SYNC lock. 
For Items 46-49, an asterisk “*” will show when 
telemetry conditions for TDRS, STDN HI, STDN 
LO, or SGLS, respectively, are met. No more 
than one asterisk will be displayed at one time. 
If data are not available from the PCMMU, all 
asterisks will be blanked. 
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S-Band Frequency Modulation 


Тһе S-band FM system cannot receive 
information; it is used to downlink data from 
up to seven different sources, one at a time, 
directly to the ground when there is a line of 
sight between the orbiter and STDN or Air 
Force ground stations. The S-band FM return 
link can originate from one of two redundant S- 
band FM transmitters aboard the orbiter. Both 
transmitters are tuned to 2,250 MHz. The S- 
band FM return link can be transmitted 
simultaneously with the S-band PM return link 
to a STDN ground station or to an Air Force 
ground station. The S-band FM return link does 
not operate through the TDRS system. 


Crew controls for the S-band FM system are on 
panel АТК. Status and configuration control of 
the S-band FM system electronic elements can 
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be selected either by panel switches or GCIL, 
depending on whether the CONTROL switch is 
set to COMMAND or PANEL. Set to PANEL, 
the switches allow rotary switch selection of the 
DATA SOURCE, and FM Power 1, Off, or 2. 


LOWER UPPER 


DATA SOURCE 


PAYLOAD RECORDER 


и5а007587 136 


S-BAND FM Switches on Panel А1К 


The FM signal processor is commanded to select 
one of seven sources for output to the S-band 
FM transmitter, which transmits it to the S-band 
ЕМ return link through the STDN ground 
station or the DOD AFSCF ground station. The 
S-band FM return link transfers one of the 
following: 


е Real-time SSME data from the engine 
interface units during launch at 60 kbps 
each (ME) 


e Real-time video (TV) 


е Solid State Recorder (part of the Mass 
Memory Units) dumps of high- or low- 
data-rate telemetry at 1,024 kbps (MMU 
1 or MMU 2) 


e Payload analog at 300 hertz or 4 MHz 
(PL ANLG) 


e Payload digital data at 200 bps or 5 
Mbps (PL DIGITAL) 


е DOD data at 16 kbps or 256 kbps in real 
time or 128 kbps or 1,024 kbps of 
playback (DOD) 
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Only one of the two FM signal processors is 
used at a time. FM signal processor 1 interfaces 
with FM transmitter 1, and FM signal processor 
2 interfaces with FM transmitter 2. The trans- 
mitters and processors cannot be сгоѕѕ- 
strapped. 


S-band FM is currently used primarily for 
transmitting ME data during ascent and 
MMU1/2 data recorder dumps during orbit 
operations. 


S-Band FM Antennas 


Two hemispherical S-band ЕМ antennas 
covered with a reusable thermal protection 
system are located on the forward fuselage 
outer skin of the orbiter approximately 180° 
apart. On the flight deck, the hemispherical 
antennas are above the head (upper) and below 
the feet (lower) and radiate the S-band FM 
return link. 


The S-band antenna switch assembly provides 
the signal switching among the two S-band FM 
transmitters and either of the two hemispherical 
antennas. The proper antenna is selected 
automatically by onboard ог real-time 
command from the ground, computer control, 
or manual flight crew selection using the S- 
BAND FM XMTR UPPER, RCVR LOWER 
switch on panel A1R. In the GPC mode, the 
onboard SM computer selects the proper 
hemispherical antenna to be used whenever an 
S-band FM transmitter is active. The antenna 
selection is based on the computed line of sight 
to the NASA STDN ground or the AFSCF 
ground stations. 
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The basic difference between the quadrant and 
hemispherical antennas is that the hemispheri- 
cal antennas have a larger beamwidth, whereas 
the quadrant antennas have a higher antenna 
gain. The hemispherical antennas are so named 
because there are two of them, one on the top of 
the orbiter and one on the bottom. 
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S-Band FM Antenna Locations 
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S-Band FM System Block Diagram 
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Ku-Band System 


The Ku-band system operates between 15,250 
MHz and 17,250 MHz. The Ku-band carrier 
frequencies are 13,755 GHz from the TDRS to 
the orbiter and 15,003 GHz from the orbiter to 
the TDRS. The Ku-band antenna is located in 
the payload bay. After the payload bay doors 
are opened, the Ku-band antenna is deployed. 
Once the antenna is deployed, the system can be 
used to transmit information to and receive 
information from the ground through the 
TDRS. The Ku-band antenna can also be used 
as a radar system for target tracking objects in 
space, but it cannot be used simultaneously for 
Ku-band communications and radar operations. 


When the Ku-band antenna is deployed and 
activated in the communications mode, the NSP 
directs the return link data stream to both the 
Ku-band signal processor and the S-band PM 
transponder. The return link data stream is 
transmitted through both the Ku-band and 5- 
band PM antennas to the TDRS in view, via the 
TDRS systems, to Mission Control. 


The NSP accepts the forward link from the Ku- 
band signal processor and the S-band PM 
transponder; however, the NSP processes only 
one of these signals. The source of the forward 
link selected for processing depends on whether 
S-band or Ku-band has been selected through 
GCIL by the ground or by the NSP UPLINK 
DATA switch on panel A1L. It is possible to 
transmit the downlink through the Ku-band 
and receive the forward link through the S- 
band, and vice versa. 


The SM software can automatically switch NSP 
uplink configuration to support either Ku-band 
or S-band PM. The SM COMMUNICATIONS 
display (SPEC 76) shows an AUTO K TO S and 
AUTO S TO К status; the status fields will show 
Enable (ENA) or Inhibit (INH), based on uplink 
command configuration for these functions. If 
both are enabled and the correct conditions are 
met in the Ku-band system (good forward link), 
the AUTO 5 TO К commands through the GCIL 
to configure the NSP for TDRS Ku. If the Ku- 
band forward link is subsequently lost, or 
failures in the Ku-band uplink occur when 
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using Ku-band forward link, the AUTO КТО 5 
function switches the NSP back to a TDRS 
S-band PM uplink configuration. The “Fail 
Safe” function, shown on SPEC 76, is no longer 
used. 


The Ku-band system can handle more data than 
the S-band systems. In either of two uplink 
communications modes, it transmits three 
channels of data, one of which is the same 
interleaved voice and telemetry processed by 
the S-band PM system. The possible sources of 
information sent on the other two channels are 
selectable by two KU SIG PROC rotary switches 
on panel A1U, one for HIGH DATA RATE and 
one for LOW DATA RATE (or by ground 
commands). 


Mode 1 return link consists of three channels. 
Channel 1 consists of 192 kbps of operational 
data (128 kbps of GPC downlist, OI and 
payload telemetry plus two 32 kbps A/G voice 
links). Channel 2 consists of a 2 Mbps low data 
rate source selectable by the crew or by MCC. 
The source for channel 2 can be one of the 
following: 


e Payload interrogator 
e Attached payload digital (OCA) 
e MMU 1 or MMU 2 SSR 


Channel 3 consists of 50Mbps high data rate PL 
MAX data (attached payload digital data, 
currently DTV real-time or playback video). 


Mode 2 return link also consists of three 
channels, but differs from Mode 1 by the data 
source selectable for Channel 3. In Mode 2, 
Channel 3 consists of a 4 Mbps high data rate 
source selectable by the crew or by MCC. The 
source for Mode 2 Channel 3 can be one of the 
following: 


e Payload interrogator 
e Attached payload analog 
e Attached payload digital (OCA) 


e Real-time CCTV video downlink 
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Ku-Band Deployed Assembly Location 
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KU-BAND Controls on Panel A1L 


The three channels of data are sent to the Ku- 
band signal processor to be interleaved with the 
return link. This signal then goes to the 
deployed electronics assembly, which contains 
the transmitter, to be transmitted to the TDRS 
through the Ku-band antenna. 


The Ku-band system forward link Mode 1 
consists of 72-kbps data (two A/G voice 
streams at 32 kbps each and 8 kbps of 
command), 128-kbps for orbiter 
communications adapter (OCA) uplink, and 16- 
kbps synchronization. Mode 2 consists of only 
the 72-kbps operational data (two A/G voice 
streams at 32 kbps each and 8 kbps of 
command). 


Three Ku-band modes of operation can be 
selected by the MODE switch on panel A1U. In 
the COMM mode, incoming signals go through 
an internal electronics assembly (EA1) to the 
Ku-band signal processor, which processes and 
routes Ku-band communications data. Voice 
and commands are sent to the network signal 
processor. A separate output from the Ku-band 
signal processor can be directed to the OCA for 
PGSC computer file uplinks. In the RDR COOP 
and RDR PASSIVE modes, incoming signals are 
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routed from the deployed electronics assembly 
to EA2, the radar signal processor. The signal is 
processed to provide target angle, angle rate, 
range, and range rate information. This status 
information is then routed to EA1 to be used for 
target tracking. 


Ku-Band Deployed Assembly 


The Ku-band deployed assembly provides the 
interface with the TDRS when there is a line of 
sight between the orbiter and TDRS. The 
assembly is mounted on the starboard sill 
longeron in the payload bay. The deployed 
assembly consists of а two-axis, gimbal- 
mounted, high-gain antenna, an integral gyro 
assembly, and a radio frequency electronics 
box. The gimbal motors position the Ku-band 
antenna, and rate sensors determine how fast 
the antenna is moving. The Ku-band deployed 
antenna assembly is 7 feet long and 1 foot wide 
when stowed in the payload bay. The graphite 
epoxy parabolic antenna dish is 3 feet in 
diameter. The deployed antenna assembly 
weighs 180 pounds. The weight of the entire 
system is 304 pounds. 
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Ku-Band Deployed Assembly 
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KU-Band Circuit Breakers on Panel R14 


The antenna dish is edge-mounted on a two- 
axis gimbal. The alpha gimbal provides a 360- 
degree roll movement around the pole or axis of 
the gimbal. The beta gimbal provides a 162- 
degree pitch movement around its axis. The 
alpha gimbal has a stop at the lower part of its 
movement to prevent wraparound of the beta 
gimbal control cable. Since the beta gimbal has 
only a 162-degree movement, there is a 4-degree 
diameter non-coverage zone outboard around 
the pole and a 32-degree diameter non-coverage 
zone toward the payload bay. 


The antenna can be steered in several selectable 
modes under manual control by the flight crew 
using panel А10 or automatically by the SM 
software. The KU BAND CONTROL switch on 
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panel АТО selects COMMAND (control Бу 
GCIL or keyboard commands) or PANEL (crew 
control by panel switches and selectors). With 
the switch in PANEL, the antenna steering 
mode can be selected using the rotary switch on 
the left side of the panel. The switch positions 
are GPC (GPC pointing and auto track), GPC 
DESIG (GPC pointing only), AUTO TRACK 
(manual pointing and auto track), and MAN 
SLEW (manual pointing only). 


At times, the Ku-band system, in view of a 
TDRS, is interrupted because the orbiter blocks 
the Ku-band antenna's view to the TDRS or 
because orbiter attitude requirements or 
payloads’ or ISS’ radiation sensitivities prohibit 
its use. 
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When the Ku transmitter is enabled and capable 
of outputting, but the MCC through ground 
commands has inhibited the RF carrier for flight- 
specific reasons, the control of this RF carrier 
radiation is called Ku antenna “masking.” These 
masking modes are used to provide protection 
from Ku radiation for payloads, EVAs, and ISS. 
The types of masking, commandable from the 
ground, include: 1) inhibiting the Ku transmitter 
when a specified beta gimbal angle is exceeded 
(beta MASK) or when both a specified beta 
gimbal angle and the orbiter hardware 
obscuration zone are exceeded (beta + MASK), 2) 
inhibiting the Ku-band transmitter in a specified 
EVA protection zone, defined by certain 
elevation and azimuth angles of the antenna 
relative to the orbiter's Х, У, and Z axes. Ku 
software also modes the Ku system to standby 
mode, if the antenna remains near the beta stops 
for a certain period of time, to prevent excessive 
antenna gimballing. 


None of these masking modes is readily evident 
to the crew unless they monitor RF out power on 
SM SPEC 76. Only the orbiter hardware 
obscuration zone is shown оп the SM 
ANTENNA display (see ANTENNA display on 
page 2.4-6). 


Ku-Band Antenna Deployment and Stowage 


When the shuttle reaches orbit, before the 
Ku-band antenna is deployed, the KU ANT 
НТВ circuit breaker on panel R14 is closed to 
energize thermostatically controlled heaters for 
the deployed electronics assembly, gimbals, and 
antenna assembly. During Ku-band activation, 
the KU ELEC and KU SIG PROC circuit 
breakers on panel R14 are closed. (There is also 
a CABLE НТК circuit breaker on panel R14. 
The Ku-band system was originally designed to 
have a cable heater, but it was never installed. 
Therefore, this circuit breaker is always open.) 
These circuit breakers provide electrical power 
to the Ku-band electronic elements, electronics 
assemblies 1 and 2, the signal processor 
assembly, and Ku-band portions of panels A1U 
and A2. Actual deployment involves the KU 
ANTENNA controls and associated talkbacks 
on panel R13L. The antenna is locked in the 
stowed position to clear the adjacent payload 
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bay doors and radiators when they are closed or 
moving. 


It normally takes 23 seconds to deploy or stow 
the assembly. In the deployed position, the 
assembly forms а 67-degree angle with the 
orbiter X axis. Activating the Ku electronics and 
taking the KU BAND POWER switch on panel 
А10 to ON frees the antenna gimbals by 
removing the gimbal locking pins. The 
beginning of stow operations contains 
approximately 30 seconds of gimbal lock 
sequencing before assembly stow begins. 


The Ku-band antenna must be stowed before 
the payload bay doors are closed in preparation 
for entry. This is done by setting the KU 
ANTENNA three-position switch on panel 
R13L to the STOW position. If the assembly 
does not respond to normal stow operations, 
the KU ANTENNA DIRECT STOW switch on 
panel R13L is used. Setting this switch to ON 
bypasses the normal stow control sequences 
and causes the assembly to be driven inside the 
payload bay. The KU ANTENNA DIRECT 
STOW switch procedure is only used if locking 
the alpha and beta antenna gimbals 15 
successful in their stow position, because entry 
with antenna gimbals unlocked may cause 
unacceptable damage. DIRECT STOW merely 
positions the entire deployed assembly inside the 
payload bay and does not affect gimbal locking. 


If neither the normal stow nor the DIRECT 
STOW can position the assembly inside the 
payload bay, the assembly can be jettisoned. To 
jettison the deployed assembly, the crew closes 
the MN A and MN C PYRO JETT SYS A and 
SYS B KU ANT circuit breakers on panel ML86B 
to provide redundant jettison power. The crew 
then activates the PYRO KU ANT ARM and 
JETT switches on panel А14, which causes a 
guillotine to cut the cables to the deployed 
assembly and releases a clamp holding it to the 
pivot assembly. The separation point is 
between the assembly and deployment 
mechanism about 20 inches above the sill 
longeron. No ejective force is imparted; the 
assembly is merely cut loose, and the orbiter 
maneuvers away from it. The jettison operation 
takes about 4 seconds. 
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PYRO JETT KU Circuit Breakers on Panel ML86B 


PYRO 
STARBOARD RMS 


© 
(521) (522) 
GUILLOTINE 


PORT RMS 


LATCHES RMS JETT 
MID LATCHES 
JETT GND ВЕЗЕТ v 


FWD 


СЭ» 


(5281 (529) (531) 
(533) 
GUILLOTINE GUILLOTINE DEADFACE 


KU ANT Switches on Panel A14 


2. SYSTEMS 2.4-18 


2.4 Communications 


и Forward fuselage 


V Guillotine 


Sill longeron 148.cvs 


Ku-Band Antenna Jettison Separation 


Ku-Band Rendezvous Radar 


The orbiter Ku-band system includes a 
rendezvous radar that skin-tracks satellites or 
payloads in orbit. For large payloads that must 
be carried into orbit one section at a time, the 
orbiter will rendezvous with the payload 
segment currently in orbit to add on the next 
section. The gimballing of the Ku-band antenna 
permits it to conduct a radar search for space 
hardware. The Ku-band system is first given 
the general location of the hardware by the 
orbiter computer; then the antenna makes a 
spiral scan of the area to pinpoint the target (in 
GPC mode). 


Radar may also be used to search for space 
hardware using a wide spiral scan of up to 60°. 
Objects may be detected by reflecting the radar 
beam off the surface of the target (RDR 
PASSIVE MODE) or by using the radar to 
trigger a transponder beacon on the target (RDR 
COOP MODE). These modes are selectable 
using the KU BAND MODE switch on panel 
А10. To date, only RDR PASSIVE MODE has 
been used. 


During a rendezvous operation, the radar 
system is used as a sensor that provides target 
angle, angle rate, and range rate information for 
updating the rendezvous navigation data in the 
GNC computer. The operation is similar to 
using the crew optical alignment sight or star 
trackers, except that the radar provides range 
data in addition to angle data. Angle tracking 
maintains appropriate antenna pointing to keep 
the target within the antenna beam. Range 
tracking is accomplished by electronically meas- 
uring the time between a transmitted pulse and 
a return pulse from the target. The return pulse 
may be reflected from a passive (skin-tracked) 
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target or cooperative target transmitter that is 
triggered by the radar-initiated pulse. The 
latter provides a longer range capability. 


Angle tracking can be accomplished in two 
ways: computer or manual designations or 
automatic (auto) servo. During manual or 
computer-designated tracking, the antenna 
beam angle is positioned by services external to 
the Ku-band system. Computer tracking (used 
in GPC and GPC DESIG modes) provides 
designated angle data based on combined target 
and orbiter state vector information. Manual 
tracking (used in MAN SLEW and AUTO 
TRACK modes) applies manually initiated rates 
to the antenna control system from switches at 
the orbiter aft flight deck station (A1U). 


Automatic angle tracking applies error rates to 
the antenna control system from a receiving 
station that measures the target position relative 
to the antenna beam center. This closed-loop 
servosystem, internal to the Ku-band system, 
ignores external computer or manual designa- 
tions. It is the only angle tracking mode that 
provides angle data for updating navigation 
data. 


Range tracking is always automatic, although 
computer-designated ranges are applied to the 
Ku-band system until automatic tracking is 
achieved. In the automatic tracking mode, the 
Ku-band system provides actual antenna angle, 
angle rate, range, and range rate data through 
an MDM for rendezvous and proximity opera- 
tions. Data routed to the indicators on panel A2 
represent hard-wired azimuth, elevation, range, 
and range rate information, which is not 
processed by the GPCs. 


Before any radar mode is used, the orbiter is 
normally maneuvered to an attitude with the 
minus Z axis pointing at the target location. In 
all modes, therefore, the radar antenna is nor- 
mally maneuvered around the minus Z axis. 


The Ku-band system provides for antenna 
steering modes, each with a different combina- 
tion of capabilities for acquiring and tracking a 
target: GPC, GPC DESIG, AUTO TRACK, and 
MAN SLEW. АП are mutually exclusive and 
crew selectable using the rotary switch on panel 
А10. 
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The GPC mode is fully automatic in all phases 
of target acquisition. Two DPS display 
commands are required before this mode can be 
initiated (GNC SPEC 33, REL NAV DISP). One 
command enables target position data to be 
routed from the GNC to the SM antenna 
management program through the intercom- 
puter data bus (GNC SPEC 33, REL NAV DISP, 
item 1). The antenna management program 
converts the target position to antenna pointing 
angles and estimated orbiter-to-target range 
data. Another command enables the antenna 
management program to send designated 
antenna pointing and range data to the Ku-band 
system through the payload 1 data bus and the 
payload forward 1 MDM (GNC SPEC 33, 
item 2). 


When the GPC mode is selected, the antenna 
points to the commanded angles and adjusts the 
ranging system to the specified range. Ша 
receive signal is detected, the automatic closed- 
loop system tracks the target in angles and 
range and provides data for the SM and GNC 
computers and panel displays. If the target is 
not detected, the antenna is automatically 
commanded to search around the designated 
point Тһе antenna is inertially stabilized 
during the search operation. 


The GPC DESIG mode provides the same 
designated pointing as the GPC mode without 
angle search or angle-tracking capabilities. No 
closed-loop angle tracking is provided. Тһе 
designated angles are updated every 2 seconds. 
Range search and tracking are automatic. The 
antenna may be either inertially or body 
stabilized. 


Тһе AUTO TRACK mode begins with manual 
antenna control, including a manually initiated 
search and inertial stabilization during the 
target acquisition phase. Once the target is 
detected, automatic angle and range tracking is 
initiated and manual control is inhibited until 
auto tracking is broken. 


The MAN SLEW mode allows manual control of 
antenna movement with maximum automatic 
range search. Once the target is detected, an 
automatic range track is initiated, but angles are 
still under manual control. No angle search is 
available in this mode. 
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Тһе SEARCH mode, selected by a switch on 
panel A1U, involves a programmed antenna 
movement that causes the radar beam to 
describe a spiral pattern starting at the 
designated angles. The beam angle spirals out 
to a maximum of 30? from the designated angle. 
In the GPC steering mode, the variation of the 
maximum angle of search from the designated 
point is inversely proportional to designated 
range. The smallest search spirals outward to a 
maximum of 6.2? from the designated point for 
ranges from 145 to 300 nautical miles (n. mi). 
At minimum ranges (0 to 8 n. ті), the spiral 
search is the maximum 30? from the designated 
point. If the antenna drive system detects but 
overshoots the target during a spiral search, a 
miniscan program is automatically initiated 
near the point of detection. Тһе miniscan 
searches to a maximum of 9? from the starting 
point in 1 minute. In the auto track steering 
mode, only the manually initiated main 30- 
degree scan is available. 


In addition to angle search, the Ku-band system 
provides a range search. The process includes 
electronically varying the timing within the 
range system until it coincides with the time 
interval between the transmitted and received 
radar pulses. Once the intervals coincide, radar 
tracking is established, and the range data 
output represents the range between the target 
and the orbiter. The crew can read the range 
and range rate values as panel and DPS display 
parameters. 


The crew is provided with two controls associ- 
ated with range. Transmitter power output is 
automatically varied in proportion to range 
when a target is being tracked to keep the 
return signal relatively constant, regardless of 
range. If, however, the track is lost, and the 
range system begins to search, the transmitter 
may transmit maximum power during the 
search. The crew can limit the maximum 
transmitter power by using an aft station panel 
control. The other control is a ОР5 command 
that limits the range search in GPC steering 
mode to 2,400 feet. 


Тһе Ku-band system has body апа inertial 
antenna stabilization modes. When the body is 
stabilized, the antenna beam remains in a fixed 
relationship to the orbiter X, Y, and Z axes 
during orbiter attitude changes. When the 
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system is inertially stabilized, the antenna beam 
remains aligned to a point in inertial space, 
regardless of the orbiter attitude changes. Both 
of these modes are effective only when the 
radar angle-tracking system is not tracking a 
target. In the target angle-tracking mode, the 
system aligns the antenna beam to the target, 
and antenna movement is independent of 
orbiter attitude changes. 


Each antenna steering mode, except the 
designate mode, has a specific stabilization 
mode. The designate mode selects either body 
or inertial stabilization on the basis of a real- 
time GPC command (not available to the crew). 
Since the designate mode provides range 
tracking only, inertial stabilization is effective 
during target tracking. 


The SM COMMUNICATIONS display, SPEC 
76, provides the status of Ku-band temperatures 
(PA, GMBL, GYRO), power out (in watts), 
frame sync, and mode (COMM or RDR), to 
flight crews. 


Payload Communication System 


The payload communication system is used to 
transfer information between the orbiter and its 
payload(s). It supports hardline and radio frequency 
communications with a variety of payloads. The 
system is used to activate, check out, and deactivate 
attached and detached payloads. 


Communication with an attached payload takes place 
through the payload patch panel at the crew 
compartment flight deck aft station, which is 
connected to payloads in the payload bay. All 
command and telemetry signals that meet the 
payload communication system specifications can be 
processed onboard. Incompatible signals can be sent 
to the ground through Ku-band or directly to 
payload ground stations. This method of 
transmission, referred to as bent-pipe telemetry, 
means that no onboard signal processing occurs 
before the telemetry is sent to the Ku-band system. 
Payload telemetry can be directly transmitted to the 
ground through the S-band FM or Ku-band systems 
via the payload interrogator, payload analog, or 
payload digital source selects or it can be combined 
with other payload data in the payload data 
interleaver (PDI). The PDI provides payload 
telemetry to the pulse code modulation master unit 
(PCMMU), where the data can be accessed for 
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display on various payload-related controls and 
displays. Then it is routed to the active NSP to be 
combined with voice and sent to MCC and POCCs, 
local to Johnson Space Center or around the world. 


S-BAND PAYLOAD 


ANT 
CONTROL POLAR 


COMMAND. L CIRC Q 


R CIRC 


CHANNEL SELECT———— — — — — —4 
n INTRG 2 


111 


INTRG 1 


PAYLOAD 


S-BAND PAYLOAD Switches on Panel A1L 


The S-band payload antenna is located on the 
top of the outer skin of the orbiter's forward 
fuselage, just aft of the S-band FM upper 
hemispherical antenna. The payload antenna is 
covered with reusable thermal protection 
system. This antenna is used as the radiating 
element for S-band payload transmission and 
reception to and from the orbiter to detached 
payloads, such as the Hubble Space Telescope 
(HST). 


Communication problems involving antenna 
position relative to payload position are not 
evident while the payload is within a half mile 
of the orbiter, along the minus Z axis. 
However, to maintain good communication 
with the orbiter from distances of several miles, 
the payload must be within an 80-degree 
beamwidth (with reference to the minus Z axis) 
of the orbiter's payload interrogator antenna. 
The boundary of the 80-degree beamwidth is 
the 3-decibel point (or half-power point), which 
must be considered during communication with 
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deployed payloads. This constraint is normally 
satisfied by the payload deployment and 
retrieval process. 


The basic elements in the payload communica- 
tion system are the payload interrogator (PI), 
payload signal processor (PSP), payload data 
interleaver (PDI), and PCMMU. These elements 
are in the forward avionics bays. Commands to 
the payload communication system are routed 
through the GCILC from the payload MDMs 1 
and 2, although these MDMs are also used for 
orbiter commanding. Status and control of 
payload communication systems can also be 
accessed by the PCMMU/PL COMM display 
(SPEC 62). For ISS missions, an orbiter interface 
unit (OIU) 1 or 2 is used to provide translation 
functions between the payload communication 
system and 1553 ISS devices. 
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Payload Interrogator 


Detached payloads communicate with the 
orbiter on an RF signal through the payload 
antenna by the payload interrogator. The 
payload interrogator is a transmitter/receiver/ 
transponder unit that provides full duplex RF 
communications between the orbiter and a 
detached payload. It transmits commands to 
and receives telemetry from NASA payloads 
through the payload antenna. Payload 
interrogator controls are located on panel A1L. 


The main carrier frequency of the detached 
payload telemetry is demodulated by the PI. 
The telemetry is routed directly to the Ku-band 
system for transmission to the ground (bent-pipe 
telemetry) when a payload signal is not compatible 
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with the PSP. For PSP compatible payloads, the 
PSP demodulates the telemetry from the subcarrier 
and sends it to the PDI to be interleaved with other 
payload data. 


Hardline payload commands аге routed 
through the PSP and then output through the 
payload patch panel directly to an attached 
payload. Detached RF commands are routed 
through the PSP and then through the payload 
interrogator for transmission to the payload 
through the payload antenna. 


The payload interrogator receiver automatically 
sweeps to acquire and track an unmodulated or 
modulated RF signal. Payload interrogator 
telemetry is available through an operational 
instrumentation MDM to verify signal strength 
and frequency lock. If payload frequencies are 
near the orbiter S-band PM frequencies, care 
must be taken to prevent interference. 


When the payload outputs a data rate that is not 
compatible with the PSP, the signal must be 
routed directly via Ku-band or S-band FM system, 
or the payload customer, such as HST team, must 
provide an interface device from the patch panel to 
the PDI. 


Payload Signal Processor 


The payload signal processor is the RF and 
hardline command interface between the 
ground or flight crew and the payload. It is also 
a detached payload telemetry interface to the 
payload data interleaver. The PSP is controlled 
by the switches on panel A1L. The PSP output 
is commanded or selected by the PSP CMD 
OUTPUT switch. 


The PI and PSP are commanded through 
GCILC/MCC or selected by the crew (AIL) 
using the associated control switches. 


In past HST servicing mission (SM) flights, a "PSP- 
Bypass” configuration was used to allow bypassing 
the PSP for HST return link telemetry via a jumper 
cable from the PI to Ше PDI.  Post-STS-61, a 
communications improvement team (GSFC and 
JSC) convened to come up with better methods of 
downlinking low-rate HST telemetry. The result 
was the HST PGSC assembly (HPGSCA). The 
main purpose of the HPGSCA was to receive the 
HST 32-Kbps data from the PI, “clean up” the bits 
and amplify them, and send the data stream to the 
PDL 
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The HPGSCA was flown оп STS-82, -103, апа - 
109. During these missions, there were some issues 
with the HPGSCA. If the laptop “hung up,” it 
required crew time to reboot the system. With this 
in mind, the HST team at Goddard (GSFC) decided 
to design a replacement for the HPGSCA with easier 
crew operation and better functionality. The 
replacement unit is the bit sync assembly (BSA). 
The BSA uses the heritage Aydin PC355 ISA cards 
and minimizes the setup, teardown, апа 
configuration time required; it should be used on the 
final HST servicing mission. 


Orbiter Interface Unit 


The OIU is an asynchronous LRU that serves two 
separate functions. The OIU checks and expedites 
commands to the ISS or devices using ISS- 
compatible protocol. It also processes telemetry 
(data) from these devices to route to the PDI in PDI- 
compatible serial data streams. Both the commands 
and telemetry path between the OIU and ISS device 
use the Military Standard 1553 B (MS 1553B) 
protocol. Specifically, the OIU is the translator, or 
interface LRU, between the orbiter PSP, the PDI, 
and the ISS command and data handling (C&DH) 
system MS 1553B communication buses. The OIU 
also provides a MS 15538 interface to the SSOR, 
adding an RF command and telemetry path to the 
ISS while in the proximity operations phase of flight 
(end of rendezvous timeline). The OIU is manifested 
like a shuttle payload whenever an ISS mission or 
payload requiring the MS 1553B protocol is flown. 


Payload Data Interleaver 


The payload patch panel interfaces attached 
payloads to the PDI. The PSP acts as the 
interface for detached payloads. Attached 
payloads are wired to specific input channels of 
the PDI via the payload patch panel during 
prelaunch activities. When the PDI 15 
reconfigured by the flight crew, programming 
procedures include assigning inputs in the PDI 
to one of four decommutators. 


The PDI allows the payload communication 
system to interface with the rest of the orbiter 
communication system and computers. | 
receives up to six different inputs from attached 
or detached payloads and one ground support 
equipment input. For missions using the 
payload signal processor, a maximum of five 
attached payloads can be accommodated on 
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inputs 1 through 5. Input 6 is reserved for 
detached payload telemetry using the RF link 
through the payload signal processor and 
payload interrogator. The PDI has four 
decommutators that can process up to four 
payload data streams. The PDI ships the 
payload telemetry to the PCMMU, where it can 
be accessed by the SM GPC for display, and 
combined with orbiter telemetry for transmis- 
sion to the ground. The PL DATA INTLVR 
POWER switch is on panel A1L. 


Ultrahigh Frequency System 


The ultrahigh frequency system actually consists of 
two separate systems with different capabilities. 
They are the UHF simplex (SPLX) system and the 
UHF SSOR system. A five-position UHF MODE 
rotary switch on panel O6 activates power to 
these systems. The OFF selection disables both 
systems. The simplex (SPLX) selection activates 
the 2597 MHz (296.8 MHz ав backup) 
transceiver. The SPLX + G RCV selection 
activates the guard 243.0 MHz emergency 
receiver together with the SPLX 
transmitter/receiver. Тһе С T/R selection 
activates the guard 243.0 MHz transceiver for 
emergency voice communications through any 
available ground station and disables the SPLX 
transceiver. Selection of any of these three 
modes automatically connects the UHF air 
traffic controller (ATC) transceiver to the orbiter 
audio central control unit (ACCU) air-to-air 
(A/A) voice loop. 


The UHF simplex, or ATC, system is used as a 
backup for the S-band PM during ascent and 
entry phases of flight for communications with 
MCC through the STDN ground stations. 
Simplex mode means that the orbiter flight crew 
can transmit or receive, but cannot do both 
simultaneously. The UHF system may also be 
used for air traffic control and two-way voice 
with chase aircraft during landing operations. 


In the SPLX or GUARD mode, the UHF 
transceiver takes the voice signal from the audio 
central control unit “A/A” loop and routes it 
through the external ОНЕ antenna on the 
bottom of the orbiter forward fuselage for 
transmission to the ground station. The 
incoming UHF signal goes through the external 
antenna to the ОНЕ transceiver, which 
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demodulates it and routes it as an audio signal 
to the audio central control unit “A/A” loop for 
distribution in the orbiter. 


Part of the UHF configuration is controlled 
through three two-position toggle switches on 
panel O6 labeled XMIT ЕКЕО, SPLX PWR 
AMPL, and SQUELCH. The XMIT FREQ 
switch selects one of the two UHF frequencies, 
259.7МН2 primary or 296.8 MHz secondary, for 
external transmission. The SPLX PWR AMPL 
switch enables or inhibits the UHF power 
amplifier circuit. When the switch is positioned 
to ON, the UHF system transmits 10 watts of 
power through the antenna. When the switch is 
positioned to OFF, the power transmission is 
reduced to 0.25 watts by bypassing the power 
amplifier circuit. SPLX SQUELCH is used in 
the SPLX mode only. The ON selection 
activates a squelch circuit to reduce background 
radio noise. This function may be selected to 
OFF if the voice communication is weak. This 
switch is normally selected to ON. 
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SPLX/GUARD UHF Subsystem Functional Block Diagram 
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EVA/SSOR UHF Subsystem Functional Block Diagram 
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Time Division Multiplexing 


The UHF MODE EVA selection activates the 
ОНЕ SSOR оғ ИНЕ EVA system and disables the 
SPLX UHF systems. In the EVA mode, a 
separate ОНЕ system is used for 
communicating voice and data between the 
orbiter, the ISS, and EVA crewmembers. The 
orbiter system is called the SSOR and is part of 
the space-to-space communications system 
(SSCS). The SSCS is a time division multiplexed 
network that provides slots for five users, 
including the SSOR, space-to-space station 
radio (SSSR), and up to three space-to-space 
EVA radios (SSER). 


The SSCS operates at 417.1 or 414.2 MHz, 
depending on the selection of the SPLX/EVA 
XMIT FREQ switch. All of the panel Об UHF 
switches, except SQUELCH, apply to the SSOR 
system. The main antenna for SSOR is mounted 
on the starboard side of the airlock truss. The 
SSOR is also connected to an antenna inside the 
orbiter airlock for EVA checkout prior to egress. 


The SSOR is connected to the orbiter audio 
system through the AIR AUDIO CENTER 
panel UHF switches. EVA conversations are 
routed to Mission Control via the S-band PM or 
Ku-band system on A/G 1 or A/G 2, depending 
on the configuration of the UHF switches on 
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panel AIR. А/С 1, A/G 2, and/or A/A may be 
used; however, A/G 1 normally is selected. 
EVA biomedical/suit data is routed through the 
OI system once it is removed from the 
UHF/SSOR carrier. 


The SSOR system has a prime and backup set of 
radios, selectable by 1 or 2 on the EVA STRING 
switch. String 1 is designated as prime. 
lransmitter power out is determined by 
selecting the SPLX/EVA PWR AMP switch. 
Low or high power is 19.1 dBm (-80 mW) to 
31.6 dBm (-1.44 УУ), respectively. High power 
is never used - it exceeds FCC limits. 


The SSOR may be operated with encryption. Ё 
so, the ENCRYPT will be selected to ON. 


The SSOR status is visible to the crew on two 
orbiter DPS displays, SM COMMUNICATIONS 
SPEC 76 and SM OIU SPEC 212. Prime (PRI) 
and backup (B/U) status are indicated. Frame 
sync (FRM SYNC) - YES indicates that all active 
SSCS users are established in the network and 
communication should be good. FRM SYNC - 
BAD indicates no communication іп the 
network. Processor status (PROC STAT) - OK 
indicates which system is on. BAD indicates the 
system is off. 
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COMMUNICATIONS Display (SPEC 76) 


The power level (PWR LEVEL) indication can 
be between 19.1 dBm and 31.6 dBm, depending 
on the SPLX/EVA PWR AMP switch selection. 
This parameter defaults *15.0 L when both 
systems are powered off (OFF or SPLX modes). 
The STATUS parameter indicates the system 
current, from 0 to 70 amps. Typically, 35 amps 
is indicated for the active system and 0.0 L is 
indicated if deactivated. 
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OIU Display (SPEC 212) 


Audio Distribution System 


Ihe audio distribution system (ADS) routes 
audio signals throughout the orbiter. It 
provides the means by which crew members 
communicate with each other and with external 
locations, such as Mission Control, through the 
S-band PM, Ku-band, UHF and SSOR systems. 
It also interfaces with the caution and warning 
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system for reception of C/W (tone) signals and 
with the three tactical air navigation (TACAN) 
sets for monitoring the TACAN audio 
identification codes. 


The major elements of the ADS include: 


1. Audio central control unit (ACCU), 
which acts as a central switchboard to 
gather and route audio signals 
throughout the orbiter. Ш is an 
internally redundant LRU. 


2. Audio terminal unit (ATU) at crew 
communication stations that permits 
crewmembers to select audio talk/ 
listen lines and to control external/ 
internal communication keying modes 
and listen volume levels. 


3. Speaker unit (SU) consisting of one 
speaker mounted on the flight deck aft 
A2 panel, the second mounted on 
middeck ceiling panel MO29J. Both 
SUs are connected to and subject to an 
associated ATU configuration. 


4. Audio center panel, which is the control 
center for extending audio buses to 
docked 156 (the "Spacelab" switches) 
and SSOR (the "UHF" switches) and 
for selecting up to two voice signals 
for recording on the solid state 
recorders in the MMUs. 


5. Loose communications equipment 
consisting of miscellaneous small, 
stowable items such as the headset 
interface unit (HIU), headset/helmet 
cables, very light weight headset 
(VLHS), multi-headset ^ adapter 
(МНА), battery powered speaker mic 
unit (BPSMU), and handheld mic 
(ННМ). 


6. Crew communications umbilical 
(CCU) jack, which is an individual 
panel-mounted jack at | crew 
communication stations where mating 
headset plugs give the crew access to 
audio buses. Each CCU location has 
an associated ON/OFF switch to 
control power to the headset interface 
unit (HIU) microphone. 
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The eight loops in the audio system are: 


1. Air-to-Ground 1 (A/G 1) 


are used to communicate from communication 
station to communication station within the 
orbiter and to ISS via hardline connections in the 


2. Air-to-Ground 2 (A/G 2) orbiter docking system (ODS). The page loop 
3. Air-to-Air (АЈА or UHF SPLX) allows one crewmember to send voice 
transmissions to all active stations. The C/W 
4. Intercom A (ICOM A) loop sounds different tones for different 
5. I B (ICOM B malfunctions or emergencies. Тһе TACAN 
жыны. ) loop, accessible only at the commander's and 
6. Paging (PAGE) pilot's stations, is used to identify TACAN 
ground stations for navigation. 
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Audio Loops and System Interface 


External communications are accomplished by 
routing А/С 1, A/G 2, and A/A. A/G1& 2are 
used to communicate with the ground through 
the S-band PM and Ku-band systems and with 
the EV crewmember through SSOR during EVA 
operations. А/А is used to communicate with 
MCC via the UHF or ATC system when over 
ground sites that support UHF. ICOM A and B 


Audio Central Control Unit 


Тһе ACCU, the heart of the audio system, is 
located in the crew compartment middeck 
forward avionics Бау. (Ihere are two 
redundant ACCUS within the same hardware, but 
only one is used at any given time.) The unit 
identifies, switches, and distributes analog 
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audio signals among the various audio 
distribution system components. Both digital 
and audio signals are received and processed by 
the ACCU. The digital signals are used to 
control the internal configuration of the ACCU 
per the switch positions on the ATUs and other 


devices. The audio signals are keyed and 
routed in response to this internal 
configuration. 


Тһе AUDIO CENTER selection switch is on 
panel C3. Setting the switch to 1 applies 
primary power to the control center unit from 
the ESS 2CA AUD CTR 1 circuit breaker on 
panel R14. Selecting 2 applies power to the 
secondary unit electronics from MN C AUD 
CTR 2 circuit breaker on panel R14. OFF 
removes all power from the ACCU. 
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NOTE 


With the AUDIO CENTER selection 
switch OFF, all normal audio functions 
will be inoperative. However, the 
commander and pilot can communicate 
via headset if one of their ATU 
CONTROL switches is set to the alternate 
position. This is also true for any two 
stations that share ATUs through an 
audio control switch position (16, 
mission specialist and payload specialist, 
airlock CCU 1 and middeck ATU, and 
airlock CCU 2 and payload specialist). 


The ACCU circuitry activates signals from the 
launch umbilical connection intercom A and B 
channels. Any crew station ATU can then be 
configured to transmit and receive intercom 
signals from Launch Control Center (LCC) 
through the umbilical. (Only intercom signals 
are processed through the umbilical.) 
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Audio Terminal Units 


Six audio terminal units (ATUs) are used in the 
crew compartment to select and control the 
volume of each audio loop . ATU panels аге 
located at the following crew stations: 


е Panel O5 (LEFT AUDIO) 
® Panel O9 (RIGHT AUDIO) 


• Panel R10 (MISSION STATION 
AUDIO) 


“ Panel 19 (PAYLOAD STATION 
AUDIO) 


“ Panel M042F (MID DECK SPEAKER 
AUDIO) 


e Panel AW18D (AIRLOCK AUDIO) 


These panels control signals routed through 
audio hardware connected to the associated 
crew communications umbilical (CCU). The MS 
ATU controls the loops routed to the Flight 
Deck speaker; the MD ATU controls the loops 
routed to the Mid Deck speaker. 


Each ATU has a three-position power switch to 
control all signals to or from the ATU. The 
switch positions are AUD/TONE, AUD, and 
OFF. In the AUD/TONE position, all available 
functions of the ATU are armed, and 
transmission and receptions may be made 
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through the ATU, depending on the position of 
other switches on the ATU. C/W tone signals 
are sent to the ACCU to allow C/W audio to 
reach the ATU, the CCU, and the speaker unit. 
The AUD position has the same functions as 
AUD/TONE except that C/W signals are 
blocked from the ATU. The OFF position shuts 
off power to the ATU power supply, for the 
ATU amplifiers. 


NOTE 


Klaxon (cabin air pressure) and siren 
(fire) C/W signals go directly to a speaker 
unit, even with the speaker power off. 


Each ATU has a two-position, PAGE switch that 
must be held in the PAGE position to activate 
the circuit. When activated, the circuit enables 
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the ATU to transmit to all other ATUs, the 
SSOR, and the docked ISS. Any number of 
stations may изе the page circuit 
simultaneously regardless of the position of the 
other channel control switches. 


On all ATUs, the two air-to-ground channels, 
the air-to-air channel, and intercom channels A 
and B have individual three-position control 
switches for selecting access to particular 
channels for transmission or reception. The 
switch positions are T/R, RCV, and OFF. The 
T/R position permits transmission or reception 
over the selected channel. The RCV position 
deactivates transmission capability on the 
selected channel and permits only reception of 
signals. The OFF position deactivates transmis- 
sion and reception on the selected channel. 
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MS AUDIO CONTROL Switch on Panel R11L 


Each channel control switch has a thumbwheel 
VOLUME control to adjust signal intensity on 
the related channel. The thumbwheels cover a 
range of approximately 27 decibels in 3-decibel 
increments. 


The XMIT/ICOM MODE rotary switch controls 
four combinations of external and intercom 
transmissions. In the PTT/HOT mode, trans- 
mission through A/G 1, A/G 2, and A/A 
requires manual keying of the audio hardware 
XMIT push-to-talk (PTT) button; ICOM A and B 
will be hot mike. In the PTT/VOX mode, A/G 1, 
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A/G 2, and A/A require PTT of the XMIT 
button, while ICOM A and B are voice keyed. | 
In the PTT/PTT mode, all voice channels аге 
push button keyed. In the VOX/VOX mode, all 
voice channels are voice activated. 


The VOX SENS rotary potentiometer on the 
ATUs regulates the volume of the signal 
required for voice keying. The MAX setting 
requires a lower decibel level to key the circuit 
than the MIN setting. 


Volume control of all incoming signals to 
speakers is adjusted by the MASTER SPEAKER 
VOLUME controls on panels A13 and MO42F. 
The airlock ATUs have unique MASTER 
VOLUME 1 and 2 potentiometers on panel 
AW18D, which control volume to the CCU1 
and CCU2 outlets in the airlock. 


Four ATUs (on panels O5, O9, AW18D, and 
R10) allow a crewmember at a malfunctioning 
ATU to switch to an alternate ATU. The left | 
may be switched to the right (commander's to 
pilots ATU), or right ATU control may be 
switched to the left (pilot's to commander's 
ATU). The commander's and pilot's CONTROL 
knobs are located on panels O5 and 09. 
Mission specialist ATU may be switched to the 
payload specialist's ATU using the MS AUDIO | 
CONTROL switch on panel R11L. Airlock ATU 
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control may be switched to the middeck and 
payload specialist's ATUs using the CONTROL 
rotary switch on panel AW18D. 


When the CONTROL switch is in the NORM 
position, control of the ATU is from the panel to 
which the knob belongs. The other position of 
the knob indicates the ATU to which control can 
be transferred. The CONTROL knob changes all 
ATU functions to the alternative ATU except 
the master volume control. This redundancy 
protection is used in the event of a failure or 
malfunction of any of the four audio terminal 
units that have a CONTROL knob. 
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Speaker Units 


Speaker units are located on panels A2 and 
MO29J. They are controlled by the MS ATU on 
panel R10 and the MD ATU on panel МО42Е. 
The speaker unit has a three-position 5РКК 
PWR switch. Only the OFF and SPKR positions 
are used. In the OFF position, no signals go 
through the associated ATU. Іп the SPKR | 
position, audio selected on the associated ATU, 
including C/W tones, are enabled. The 
SPKR/MIC position is functionally identical to 
the SPKR position. The top speaker is used for 
audio and the bottom is dedicated to the 
klaxon/ siren. 


The KEY light on the speaker illuminates when a 
microphone on the associated ATU is keyed 
(PTT, VOX, ек.). The KEY light indicates that 
the speaker is muted. 


Audio Center Panel 


The AUDIO CENTER controls on panel A1R 
have four functions: voice interface capability 
with SSOR (UHF switches) and docked ISS 
(Spacelab switches), the payload bay comm 
outlets (not used), and loop selection for 
recording. All switches on the panel send 
digital impulses to the ACCU, enabling the 
selected functions to communicate with the 
docked ISS, SSOR, and recorders. 


Two rotary knobs labeled VOICE RECORD 
SELECT control various audio signals to be sent 
to the recorders via the NSP. A/G 1, A/G 2, A/A, 
and ICOM A or B audio can be sent to either 
recorder. Any two signals may be recorded at 
the same time, one on channel 1 and the other 
on channel 2. Either channel may be turned 
off. 
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AUDIO CENTER Controls on Panel A1R 


Loose Communications Equipment 


Launch and Entry Helmets 


During launch and entry, each flight 
crewmember wears a launch and entry 
helmet to lessen the severe noise levels 
encountered at launch and to allow 
intelligible air-to-ground communications. А 
communications carrier assembly (CCA) 
headset containing microphones апа 
earphones fits over the crewmember's head. 
Also, there is a connector and cable interface 
with the HIU, which is connected through 
communications cables to Ше respective crew 
communication umbilical and associated ATU. 
The microphones can be positioned to suit the 
individual crewmember. For emergency 
egress, a pull-away connection is used 
between the communications carrier assembly 
and headset interface unit, in addition to the 
standard communications carrier 
assembly/headset interface unit twist-on 
connector. 


The helmets have redundant noise-canceling 
microphones and electrically isolated 
earphones. When air is inhaled, the demand 
breathing regulator shuts off the microphones 
to avoid transmitting breathing sounds. | 


NOTE 


An improper face seal will cause enough 
oxygen flow to cut off microphones. | 


Headset Interface Unit 


The headset interface unit has separate push- 
to-talk (PTT) buttons for transmit and 
intercom modes and a volume control that 
determines the level of sound heard through 
the earphone (microphone sound level is 
determined by automatic gain control 
circuitry within the audio terminal unit). 
Push-to-talk means that a pushbutton must be | 
depressed to allow a crewmember to talk 
through the system. The transmit (XMIT) 
pushbutton allows access to intercom (1СОМ) 
and external circuits, while the ICOM 
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pushbutton is for intercom only. The volume 
control knob acts in series with the loop 
volume controls on the associated audio 
terminal unit (ATU). In addition, the 
commander and pilot have PTT switches on 
their rotational hand controllers for XMIT 
keying. 


The headset interface unit provides volume 
control and РТТ capabilities to the 
communications carrier assembly used for 
EVA and to the communications carrier 
assembly. The headset interface unit has a 
clip that attaches to the crew's flight suits. 


Headset Interface Unit 
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Crewman Communications Umbilical 
on Panel L5 


Cables 


The communication cables vary in 
configuration, depending on seat location. 
Each seat has two 4-foot communication 
cables or a 14-foot length, as required. One 
4-foot cable is flown as a spare. The cables 
connect to crewman communications 
umbilical (CCU) outlets at various locations 
in the crew compartment. Each CCU has a 
specific audio terminal unit that controls 
communication loop configurations. The 
CCU associated with the ATU on panel O5 is 
located on panel L5 (LEFT COMM); for O9 on 
R6 (RIGHT COMM); for R10 on A11 (MS 
COMM), for L9 on A15 (PS COMM), and for 
МО42Е on МОЗ9М (MID DECK COMM); two 


others for the airlock ATU аге located оп 
panel AW82D (CCU 1 and CCU 2). 


Each CCU outlet has a power switch that 
controls the associated microphone power. If 
the CCU power is off, it results in a listen-only 
mode, independent of audio terminal unit 
configuration. 


Multiple Headset Adapter 


A multiple headset adapter (MHA) may be 
plugged into the CCU outlets. It contains 
three additional CCU outlets to allow up to 
three crewmembers to share one CCU outlet. 
When any one person connected to an MHA 
keys (in РТТ mode) or activates the voice- 
operated transmitter, all three microphones 
will be keyed, and individuals sharing the 
MHA will hear each other talking on the side 
tone. 


Wireless Communications Units 


Wireless communications units are rarely 
used by current crews. On orbit, the crew 
may use wireless communication units in 
place of communication cables. A wireless 
unit consists of one wall unit (audio interface 
unit) and two leg units (crew remote units) 
worn by crewmembers during orbital 
operations. The wall unit connects to a CCU 
outlet and remains attached to the crew 
compartment wall. Each wall unit transmits 
on a unique pair of UHF frequencies. Leg 
units may be configured to work with any 
wall unit. A leg unit may be converted into a 
wireless handheld microphone by attaching a 
noise-cancelling mic at the headset connector. 
Each wall unit is identified by a letter 
enclosed in a box. Each unit is stowed with 
its cabling attached. The wall unit has a 23- 
inch cable to interface with the CCU outlet, 
and the leg unit has a 22-inch cable attached 
to a lightweight headset. 


NOTE 


If the two leg units are set to use the same 
frequency, one of the units' transmit 
signals will be muted. 
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When the wireless unit is unstowed, part of 
the assembly necessary is to insert and tighten 
the flexible antenna in the bottom of each wall 
and leg unit. The wall unit receives power 
from the CCU outlet. All other switches are 
set as required; typically, the individual 
communication loops are used. The leg unit 
is attached to the crewmember's leg with a 
wraparound elastic strap. The rotary 
ON/OFF/VOLUME knob (unlabeled) is 
turned clockwise past the ON/OFF detent, 
and the volume is set as desired. Each leg 
unit is powered by a replaceable lithium 
battery pack. A weak battery is identified by 
a continuous beeping sound when the leg 
unit is powered on. A single battery pack 
provides about 35 hours of service. Sliding a 
new battery pack into the unit causes both the 
electrical connector and mechanical connector 
to latch. 


Very Lightweight Headset 


The very lightweight headset (VLHS) is the 
interface between the leg unit and 
crewmember. A single-strand wire headband 
holds the earphone against the ear and 
supports a thin boom holding а noise- 
cancelling microphone near the mouth. A 
cable and connector are attached to the 
crewmember's leg unit. The lightweight 
headset cable and connector also can interface 
with the headset interface unit. 


Very Lightweight Headset 
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Handheld Microphone 


The handheld microphone is а noise- 
canceling microphone that connects directly 
to any CCU outlet. The microphone is used 
primarily with the SUs located at panels A2 
and MO29J. To avoid feedback when using 
the speakers, one ATU and its corresponding 
CCU outlet on the aft flight deck and one 
ATU and associated CCU on the middeck are 
equipped with a speaker muting capability. 
Muting is controlled through ATUs at panels 
R10 and MO42F. 


Two PTT pushbuttons are provided for XMIT 
and ICOM audio modes. When used to 
record audio on the videotape recorder, either 
can be used. The pushbuttons should face the 
operator to ensure that the noise-canceling 
feature of the microphone remains functional. 
The handheld microphone is equipped with a 
7-foot cable that can connect at any CCU or to 
other cables. Тһе microphone/SU config- 
uration is used for on-orbit communication 
configurations. 


Instrumentation 


Orbiter operational instrumentation (OI) 
collects, processes, and routes information 
from transducers and sensors throughout the 
orbiter and its payloads. More than 3,000 
data parameters are monitored. 


The instrumentation system consists of trans- 
ducers, 14 dedicated signal conditioners 
(DSCs), 7 MDMs, 2 PCMMUs, 2 recorders, 
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master timing equipment, and onboard 


checkout equipment. 


The ОГ system senses, acquires, conditions, 
digitizes, formats, and distributes data for 
display, telemetry, recording, and checkout. 
It provides for pulse code modulation 
recording, voice recording, and master timing 
for onboard systems. Instrumentation 
equipment, except sensors and selected 
dedicated signal conditioners, is located in the 
forward and aft avionics bays. Sensors and 
DSCs are located throughout the orbiter in 
areas selected on the basis of accessibility, 
minimum harness requirements, апа 
functional requirements. Abbreviations used 
to designate the locations of equipment are as 
follows: OA refers to operational aft, OF to 
operational forward, OL to operational left, 
OR to operational right, and ОМ to 
operational mid. 


Dedicated Signal Conditioners 


Dedicated signal conditioners acquire and 
convert various sensor data from thousands 
of orbiter sensors into a 0-5 V dc pulse 
acceptable to MDMs. Sensors requiring DSCs 
include frequency, temperature, rate, voltage, 
current, and analog parameters. 


There are 14 orbiter DSCs, 4 in forward 
avionic locations (OFs), 3 in the aft avionic 
bays (OAs), 3 under the payload bay (MID) 
(OMs), and 4 in the right and left tail sections 
(ORs and OLs). 


USA007587 


Rev. A 
A/Gs 
1 and 2 
О! Ol data 
МОМ Voice Е 
igitize 
TLM voice S-band 
Attached 64 and PM 
Payload | PL data PL data 128 Kbs NSP system 
distribution Г РОГ ГЭ Г = 
рапе! PCMMU 
Detached 
PL data Кеа 
Downlist data S-ban 
SSRs ГК” ЕМ 
PSP system 
System data 
K-band 
TFL SM 
| 
Р| MMU GPC р- system 
AIG — Air-to-Ground PCMMU — Pulse Code Modulation Master Unit 
CIU — Communication Interface Unit PDI — Payload Data Interleaver 
GPC — General Purpose Computer PI — Payload Interrogator 
MDM — Multiplexer/Demultiplexer PL — Payload 
MMU — Mass Memory Unit PSP — Payload Signal Processor 
NSP — Network Signal Processor SM — Systems Management 
О! — Operational Instrumentation TFL — Telemetry Format Load 
SSR — Solid State Recorders TLM — Telemetry 


Operational Instrumentation System Overview 


Multiplexer/Demultiplexers (MDMs) 


MDMs can operate іп two ways. As multiplex- 
ers, they take data from several sources, convert 
the data to serial digital signals (a digitized 
representation of the applied voltage), and 
interleave the data into a single data stream. As 
demultiplexers, the MDMs take interleaved 
serial digital information, separate and convert 
it to analog, discrete, or serial digital, and send 
each separate signal to its appropriate destination. 


The OI MDMs act only as multiplexers. Upon 
request from the pulse code modulation master 
unit (PCMMU), the MDMs send these inter- 
leaved streams to the PCMMU through the OI 
data buses. When the MDM is addressed by the 
РСММО, the MDM selects, digitizes, and sends 
the requested data to the PCMMU in serial 
digital form. The PCMMU/OI MDM interface 
is based on demand and response; that is, the 
OI MDMs do not send data to the PCMMU 
until the PCMMU makes the request. There are 
seven OI MDMs, four OFs, and three OAs for 
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forward and aft multiplexing of DSC and direct 
data signals. 


Pulse Code Modulation Master Unit 
(PCMMU) 


The PCMMU receives data from the OI MDMs, 
downlist data from the GPCs under control of 
flight software, and payload telemetry from the 
Payload Data Interleaver (РО). It then 
interleaves the data, formats data according to 
programmed instructions stored within the 
РСММО (the telemetry format load, or TFL), 
and sends the interleaved data to the network 
signal processor to be combined with the air-to- 
ground voice data from the audio central 
control unit for transmission through the 5- 
band PM downlink and Ku-band system return 
link, channel one. Telemetry from the PCMMU 
is also sent through the network signal 
processor to the solid state recorders (SSRs) for 
storage and subsequent downlink on the S-band 
ЕМ or Ku-band system. ОТ and payload data 
collected by the PCMMU are available to the 
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GPCs for display and monitoring purposes 
upon request. All data received by the PCMMU 
are stored in memory and periodically updated. 


The PCMMU has two formatter memories: 
programmable read only (PROM) and random 
access (RAM). The read-only memory is hard 
coded; the RAM is reprogrammed several times 
during flight. The PCMMU uses the formatters 
to load data from the computers and ОТ MDMs 
into PCM telemetry 4аа streams Юг 
downlinking. 


NOTE 


When the PCMMU is powered off (as 
when switching to the alternate unit), the 
TFL changes to the fixed format loaded in 
the PROM. 


One of the two redundant PCMMUs and net- 
work signal processors operates at a time. The 
one used is controlled by the crew through the 
flight deck display and control panel. The 
primary port of each MDM operates with 
PCMMU 1 and the secondary port operates 
with PCMMU 2. 
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OI PCMMU Controls on Panel C3 


The PCMMUs receive a synchronization clock 
signal from the master timing unit. If this signal 
is not present, the PCMMU provides its own 
timing and continues to send synchronization 
signals to the payload data interleaver and 
network signal processor. 


The OI PCMMU controls are located on panel C3. 


Master Timing Unit 
Тһе master timing unit is a stable crystal- 
controlled timing source. It provides 


synchronization for instrumentation, payloads, 
and other systems. The master timing unit is de- 
scribed in more detail in Section 2.6. 
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Obsolete Recorder Controls on Panel A1R 


Solid State Recorders 


Two solid state recorders (SSRs) are used for 
serial recording and dumping of digital voice 
and pulse code modulation (PCM) data from 
the OI systems. These recorders are embedded 
іп the mass memory units (MMUS); therefore, 
the recorders are labeled “MMU1” and 
“ММО?” on panel A1 for dumps through Ku- 
band or S-band FM. The recorders аге 
controlled entirely by ground command, with 
no crew controls available. 
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Communications System Summary 


2. SYSTEMS 


The orbiter communications system 
transfers information between the orbiter 
and the ground, either through hardline or 
radio frequency links. 


The system is divided into several smaller 
systems: S-band phase modulation (PM), 
S-band frequency modulation (FM), Ku- 
band, UHF, payload communications, 
audio, and CCTV. 


The S-band PM system provides two-way 
communication between the orbiter and the 
ground, through either an STDN/SGLS 
ground station or a TDRS. It provides 
channels for five functions: command, 
voice, telemetry, turnaround tone ranging, 
and two-way Doppler tracking. 


Four quadrant S-band antennas provide a 
selection of eight directions. 


The S-band FM system cannot receive 
information. lt is used to downlink data 
directly to the ground from seven different 
sources: SSME interface units, the video 
switching unit, the solid state recorders, 
payload analog, or payload digital. 


There are two hemispherical S-band FM 
antennas. 


The Ku-band system provides for on-orbit 
communication between the orbiter and the 
ground. It can also be used as a radar 
system for tracking objects in space. 


The Ku-band antenna is deployed when the 
payload bay doors are opened, and stowed 
when they are closed. The antenna is 
steerable. 


TV data can be downlinked over Ku-band 
and S-band FM only. 
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The payload communication system is used 
to transfer information between the orbiter 
and its payloads. 


The UHF simplex system is used as a 
backup for the S-band PM and Ku-band 
voice communications. SSOR is used as the 
primary communications link with EVA 
astronauts. 


The audio distribution system gathers 
audio signals from multiple sources and 
routes them throughout the orbiter. It is 
used as the means by which crewmembers 
communicate with each other and with 155 
during rendezvous and undocking. 


The major elements of the audio 
distribution system are: the ACCU, ATU, 
speaker units, CCU, and loose 
communications equipment. The audio 
center panel allows the crew to connect the 
audio distribution system to SSOR, docked 
ISS, and SSRs. 


Orbiter operational instrumentation (OI) 
collects, routes, and processes information 
from transducers and sensors throughout 
the orbiter and its payloads. 


The OI system consists of transducers, 14 
DSCs, 7 MDMs, 2 pulse code modulation 
master units, encoding equipment, 2 solid 
state recorders, master timing unit, and 
onboard checking equipment. 


Major communications equipment and 
control panels аге АЛК, А10, АТ, R13L, 
ОБ, Об, 09, R10, 19, and R12. Others are 
found on panels А13, А14, А15, L5, F9, СЗ, 
R11L, R15, MO29J, MO42F, and AW18D. 


Specific communications system DPS 
displays are OPS 201 ANTENNA, 
COMMUNICATIONS (SPEC 76), and PC 
MMU/PL COMM (SPEC 62). 
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Communications System Rules of Thumb 


e When the TDRS has an elevation of greater 
than +70° or less than -60° relative to the 
orbiter (as shown on OPS 201), there is a 
risk of degraded communications as the 
orbiter nose or tail blocks line of sight 
between the orbiter antenna and the TDRS. 


• Power amplifiers are specified to have а 
minimum power output of 100 watts. 
Flight experience has shown that a good 
downlink can be sustained with a power 
out of 65 watts. Power amplifiers require 
140 seconds to warm up if not in a standby. 
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Description 


Several types of equipment and systems that the 
crew uses are not covered in other sections of 
this manual, since they are not necessarily part 
of any of the larger systems. These items and 
systems, which focus on crew efficiency and 
comfort, are discussed in this section. Where 
appropriate, operations are described within 
each separate subject area. 


Crew Clothing/Worn Equipment 


The crew clothing/worn equipment consists of 
items that provide for the personal needs of all 
crewmembers. Prior to each flight, crewmem- 
bers select clothing and worn equipment from a 
list of required and optional flight equipment. 


Crew clothing used during on-orbit activities 
includes such items as trousers, jackets, shirts, 
sleep shorts, soft slippers, and underwear. 


Optional worn/carry-on equipment includes 
scissors, sunglasses, HP48 calculators, gray 
tape, flashlight, Swiss army knife, pens and 
pencils, and chronographs. 
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Personal Hygiene Provisions 


Personal hygiene and grooming provisions are 
furnished for both male and female flight 
crewmembers. Ambient warm water for wash- 
ing comes from a personal hygiene hose (PHH) 
attached to the galley auxiliary port. Other 
personal hygiene provisions are stowed in 
middeck lockers and/or a middeck or airlock 
stowage bag at launch and are removed for use 
on orbit. 


A personal hygiene kit is furnished for each 
crewmember for brushing teeth, hair care, 
shaving, nail care, etc. Additional grooming 
and hygiene items are available for female 
crewmembers in the female preference bags. 


Two washcloths and опе towel рег 
crewmember per day are provided. In addition, 
wet wipes, tissues, and "wet washes аге 
provided for personal hygiene. The "wet wipes 
are located in Volume G (spares), a middeck 
locker, and in the galley. Wet washes and 
tissues are stowed in the waste management 
compartment (WMC) and in a middeck locker. 
Rubber grommets in the waste management 
compartment allow crewmembers to restrain 
their towels and washcloths. 


If the WMS becomes nonfunctional, 
contingency equipment is located in Volume G. 
This equipment consists of "wet washes, urine 
collection devices, diapers, and Apollo fecal 
bags. 


Sleeping Provisions 


During а one-shift operation mission, all 
crewmembers sleep simultaneously. At least 
one crewmember wears a communication head- 
set to ensure reception of ground calls and 
orbiter caution and warning alarms. 


А 24-hour period is normally divided into an 
8-hour sleep period and a 16-hour wake period 
for each crewmember. Three hours are allo- 
cated for pre/post sleep activities in which 
crewmembers perform housekeeping, orbiter 
cleaning, sleep and wake preparation, personal 
hygiene, and food preparation and eating 
activities. 
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Sleeping provisions for crewmembers consist of 
sleeping bags and liners, or rigid sleep stations 
with one sleeping bag and two liners per bunk. 
Sleeping bags are installed on the starboard 
middeck wall and relocated for use on orbit. 
Some sleeping bags can remain on the starboard 
wall, and some can be attached via pip pins to 
the middeck lockers. Others can be relocated to 
the airlock, or flight deck (crew preference). A 
sleeping bag is furnished for each crewmember 
and contains a support pad with adjustable 
restraining straps and a reversible/removable 
pillow and head restraint. 


Eight adjustable straps permit the sleeping bag 
to be adjusted to its proper configuration. Three 
helical springs above the adjustable straps on 
one side of the bag relieve loads exerted by the 
crewmember on the crew compartment struc- 
ture. Eight pip pins allow the bag to be 
attached to the middeck locker face in either a 
horizontal or vertical configuration. Two elastic 
adjustable straps restrain the upper and lower 
parts of the body in the bag. Velcro strips on 
the ends of both sides of the head restraint 
attach it to the pillow. A double zipper 
arrangement permits the sleeping bag to be 
opened and closed from the bottom to the top of 
the bag. One zipper on each side of the sleeping 
bag allows the bag to be attached to a support 
pad for better rigidity. 


<< cloth tunnel (3) 
” V ч 

e 

~ 


Buckle Нар 
(snap-fastened over buckle) 


A sleep kit is provided for each crewmember 
and is stowed in the crewmember's clothing 
locker during launch and entry. Each kit con- 
tains eye covers and ear plugs for use as 
required during the sleep period. 


For 24-hour operations missions, the four-tier, 
rigid sleep station is flown. If manifested, it is 
installed on the starboard side of the middeck. 


The four-tier rigid sleep stations contain a 
sleeping bag/liner, personal stowage provi- 
sions, a light, and a ventilation inlet and outlet 
in each of the tiers. The Nomex knit sleeping 
bag is installed on the ground in each tier and 
held in place by eight spring clips. The light in 
each tier is a single fluorescent fixture with a 
brightness control knob and an off position. 
The air ventilation inlet duct is an air diffuser 
similar to an automobile ventilation duct. It is 
adjusted by moving the vane control knob. The 
air ventilation outlet duct is located in the fixed 
panel at each tier and is opened or closed by 
moving the vane control knob. The air inlet is 
located at the crewmember's head. The outlet is 
at the feet. All crewmembers’ heads are toward 
the airlock and their feet toward the avionics 
bay. 


Reversible/removable pillow 
(Nomex and Pyrell foam) 


Personal sleeping bag 
(Nomex knit) 
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Exercise Equipment 


The purpose of exercise during flight is to help 
prevent cardiovascular deconditioning and to 
minimize bone or muscle loss іп the 
crewmembers. Currently the cycle ergometer 
(CE) is the primary equipment used to achieve 
this end. 


The CE attaches to the middeck floor studs. The 
mounting frame is reconfigured on orbit to 
attach to standard seat floor studs on the flight 
deck or middeck. The CE uses a standard 
flywheel and braking band system to generate 
the required resistive force. Cycling resistance 
can be controlled electronically by a control 
panel or by a manual adjustment similar to 
those found on exercise cycles used at home or 
in gymnasiums. An accessories bag, which is 
strapped to the top of the ergometer for launch 
and entry, contains the attachable hardware as 
well as crew clothing and shoes necessary for 
nominal operations. 


Housekeeping Equipment 


In addition to time scheduled for sleep periods 
and meals, each crewmember has housekeeping 
tasks that require from 5 to 15 minutes of time 
at intervals throughout the day. These include 
cleaning of the waste management compart- 
ment, the dining area and equipment, floors and 
walls (as required), and the cabin air filters; 
trash collection and disposal; and changeout of 
the crew compartment carbon dioxide (lithium 
hydroxide) absorber canisters. (Changeout of 
the canisters is discussed in Section 2.9.) 


The materials and equipment available for 
cleaning operations are biocidal cleanser, dis- 
posable gloves, general-purpose wipes, and a 
vacuum cleaner. The vacuum is stowed in a 
middeck locker or the middeck 
accommodations rack (MAR), апа the 
remaining hardware is stowed primarily in the 
waste management compartment. Additional 
wipes are located with extra hygiene 
consumables stowed in the middeck, and an 
additional pair of gloves is located in each 
personal hygiene kit. 


The biocidal cleanser is a lotion-type detergent 
formulation in a container approximately 2 
inches in diameter and 6 inches long with a 
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built-in dispenser. The cleanser is squirted on 
the surface to be cleaned and wiped off with 
dry, general-purpose wipes. It is used primarily 
for periodic cleansing of the waste collection 
system urinal and seat. It can be used to clean 
the dining area and equipment and to clean 
walls and floors. Disposable plastic gloves are 
worn while using the biocidal cleanser. 


A vacuum cleaner is provided for general 
housekeeping and cleaning of the crew com- 
partment air filters and Spacehab filters (on 
Spacehab missions). It has a normal hose, 
extension hose, and several attachments. The 
crew will fly either an ac or dc powered version 
depending on orbiter power constraints for the 
mission. Тһе dc vacuum cleaner has the 
additional capability of containing wet spills. A 
muffler to reduce noise is part of the vacuum 
cleaner assembly. 


Trash management operations include routine 
stowage of wet and dry trash, such as expended 
wipes, tissues, and food containers. (Wet trash 
includes all items that could offgas.) The equip- 
ment available for trash management includes 
three trash bags, trash bag liners, wet trash 
volumes, and the waste collection system (WCS) 
coffee canister. 


Three trash bags for dry trash are located in the 
crew compartment: one on the inside of the 
WMC door, one on the port side of the "ditch" 
area, and one on the port side of the flight deck. 
Each bag contains one installed disposable trash 
bag liner and seven spare liners (located outside 
the installed liner but inside the trash bag). 
When the liner becomes full, it is removed and 
stowed in a jettison stowage bag and a new liner 
is installed. 


The WMC wet trash compartment has a volume 
of 1.85 cubic feet and is vented overboard for 
odor control. Trash from the WMC is inserted 
into the circular opening of the auxiliary wet 
trash compartment and is contained by an 
elbow bag. Tissues, as well as used WCS coffee 
canister bags, are disposed of in this wet trash 
compartment. The coffee canister, which is 
about the same size and shape as an off-the- 
shelf can of coffee, is installed near the WMC 
during post insertion. Trash bags are inserted 
in the canister and are filled with wipes used for 


2.5-4 


fecal collection. After each WCS изе, a used 
trash bag is disposed of in the WMC wet trash, 
and a new one is retrieved from the stowage 
volume on the WMC wall and installed in the 
canister. 


An 8-cubic-foot wet trash stowage compartment 
is available under the middeck floor (Volume 
F). This compartment is vented overboard 
(3 Ib/day) for odor control. Any item that can 
create an odor is considered to be wet trash and 
is disposed of there. 


Restraints and Mobility Aids 


Restraints and mobility aids are provided in the 
orbiter to enable the flight crew to perform all 
tasks safely and efficiently during ingress (1-g, 
orbiter vertical), egress (1-g, orbiter horizontal), 
and orbital flight (orbiter orientation arbitrary). 


Mobility aids are located in the crew 
compartment for movement of the flight crew- 
members during ingress, egress, апа orbital 
flight. These devices consist of permanent and 
soft handholds, a platform and emergency 
egress net (also referred to as the trampoline) in 
the middeck, and an interdeck access ladder. 


Restraints consist of foot loop restraints, seat 
restraints, retention nets, Velcro, tape, snaps, 
cable restraints, clips, bungees, and tethers. 


Foot loop restraints are cloth loops attached to 
the crew compartment decks by adhesive to 
provide stability in zero g. Before launch, the 
foot loop restraints are installed by the crew 
compartment configuration drawings (CCCD) 
by Flight Crew Equipment (FCE) personnel on 
the floor areas of the aft flight deck work 
stations, middeck, and near the waste manage- 
ment system and galley. Spares are stowed in 
the modular lockers. To install a foot restraint, 
the protective backing on the underside of the 
restraint is removed, and the restraint is placed 
in its desired location. The foot loop restraints 
are easily used by placing a foot in the loop. 


Seat restraints are similar to foot loop restraints. 
They can be installed prelaunch, and spares are 
manifested in the same location as the foot 
restraints. One adhesive patch is placed on one 
side of the seat, and the other patch is placed on 
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the opposite side. A restraint strap is placed 
over the seat back and attached to each patch 
via clips. 


A mesh middeck retention net, attached to the 
forward middeck lockers and the starboard wall 
(no sleep station), is used to restrain the inflight 
stowage bags, as well as other hardware. The 
airlock stowage net, also made of mesh net, can 
restrain this equipment in the airlock if the sleep 
station is manifested, or if the crew determines 
they wish to stow this hardware in the airlock. 


Velcro, tape, snaps, cable restraints, clips, 
bungees, and tethers are all manifested in the 
IFM locker and can be utilized for a variety of 
purposes. 


Stowage Containers 
Inflight Stowage Bags 


Ten inflight stowage bags are manifested, one 
per crewmember plus spares. These mesh bags 
are used to stow suits, boots, and harnesses on 
orbit. 


Flight Deck Stowage Bags 


The flight deck stowage bags provide restraint 
for flight deck items when those items are not 
immediately returned to locker stowage com- 
partments. These bags are manifested in the 
Flight Data File (FDF) locker and are installed 
on orbit on the back of the CDR and PLT seats 
(one per seat). 


Jettison Stowage Bags 


The jettison stowage bags are used for 
restraining dry trash or early return items, such 
as FDF, film, and cassettes. (See Section 2.25 for 
further details on all stowage bags.) 


Reach and Visibility Aids 


Reach and visibility aids are hardware items 
that assist the flight crew in monitoring and 
manipulating displays and controls throughout 
various phases of flight. These aids consist of 
CDR/PLT adjustable mirrors, CDR/PLT two 
axis (Z and X) seat adjustment, wicket tabs, and 
an auxiliary reach mechanism. 
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The adjustable mirrors are installed at launch on 
handholds located between windows 2 and 3 
for the CDR and windows 4 and 5 for the PLT. 
During ascent and entry, the CDR and PLT use 
the adjustable mirrors to facilitate seeing con- 
trols that are in the obscured areas of their 
vision envelope. On orbit, mirrors can be 
removed and stowed, if desired. 


To install the adjustable mirror, place the split 
clamp halves around the handhold, fit the 
handwheel stem into both clamp halves, and 
tighten the handwheel clockwise. To adjust the 
mirror, loosen the mirror-lock knob (counter- 
clockwise) move the mirror to the desired 
orientation, and tighten the mirror-lock knob. 


The CDR/PLT seats provide the CDR and PLT 
with the capability to move their seats along the 
orbiter Z- (vertical) and X- (longitudinal) axes to 
facilitate the reach and visibility of controls 
during the ascent and entry phase of flight. Seat 
movement for each axis is provided by a single 
ac motor. The total travel distances for the 
Z- and X-axes are 10 and 5 inches, respectively. 
Seat adjustment controls are located on the left 
side of the seat pan. The controls consist of a 
three-position toggle switch for power bus 
selection and one spring-loaded, three-position 
toggle switch each for control of horizontal and 
vertical seat movement. 


Adjustable Mirror 
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Seat Power and Controls 


To operate the CDR/PLT seat, the crewmember 
must first assign ac power to his or her seat 
motors by moving the POWER BUSS SEL 
switch to AC2 (up) or AC3 (down). To move the 
seat along the horizontal axis, crewmembers 
must actuate the HORIZ CONTR toggle switch 
FWD to move the seat forward and AFT to 
move the seat aft. Similarly, to move the seat 
along the vertical axis, the crewmember must 
actuate the VERT CONTR toggle switch UP to 
move the seat upward and DN to move the seat 
downward. 


If the seat motors fail to work, and seat 
adjustment is needed, manual adjustment 
capability is provided. However, manual seat 
adjustment can take place only on orbit and is 
accomplished with a special seat adjustment 
tool provided in the in-flight maintenance tool 
kit. | Manual horizontal and vertical seat 
adjustment control locations are under the seat 
pan cushion and on the aft side of the fixed seat 
structure. 


The seat adjustment tool is a ratchet-driven, 


vertical or horizontal manual adjustment to 
move the seat along the Z- or X-axis. 


Wicket tabs are devices that help the crewmem- 
ber activate controls when his or her vision is 
degraded. The tabs provide the crewmember 
with tactile cues to the location of controls to be 
activated as well as a memory aid to their 
function, sequence of activation, and other 
pertinent information. Wicket tabs are found on 
controls that are difficult to see on panels O8, C3, 
and R2 during the ascent and entry flight phases. 


The auxiliary reach mechanism, sometimes 
known as the “swizzle stick,” is a short adjust- 
able bar with multipurpose end effectors that 
are used to actuate controls that are out of the 
reach of seated crewmembers. The reach aid is 
used to push in and pull out circuit breakers, 
move toggle switches, and turn rotary knobs. It 
is stowed on the inboard side of the PLT seat. It 
may be used during any phase of flight, but is 
not recommended for use during ascent because 
of the attenuation and switch-cueing difficulties 
resulting from acceleration forces. 


3/16-inch Allen wrench inserted into the ^ Operation of the reach aid consists of extending 
it and actuating controls with the end effector. 
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To extend the reach aid, the crewmember 
depresses the spring-loaded extension tab and 
pulls the end effector out to the desired length. 


е 


T»0-4-»o0 


Wicket Tabs on Panel C3 


The reach and visibility envelope of each 
crewmember is limited by the ACES. Tactile 
cues are restricted by the ACES glove. Visibility 
is reduced because of the helmet and neck ring, 
and reach is restricted by the bulk of the ACES 
and the parachute and harness. Crewmembers 
should practice techniques that enable them to 
adjust their reach and visibility envelope. The 
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helmet can be swiveled on the neck ring. The 
neck ring tie down may be adjusted to help 
open up downward field of view. Mirrors, the 
auxiliary reach mechanism (swizzle stick), and 
other crewmembers can aid in locating and 
actuating controls. Seat headrest pads and 
helmet pads may be used to adjust the position 
of the head in the seat and in the helmet. The 
CDR and PLT seats may be adjusted as 
necessary. 


Photographic Equipment 


One still camera system is used on orbit to document 
crew activities, meet payload requirements, and 
record Earth observations. Additional cameras can 
be stowed as required. Nikon D2Xs digital still 
single lens reflex (SLR) cameras are flown for still 
photography. Тһе Nikon D2Xs electronic still 
camera stores digital still images on removable 
compact flash cards. Digital images can be 
downlinked for printing апа distribution. 
Additional camera systems may be flown for specific 
experiments or as part of an ongoing NASA 
evaluation of new cameras and technology. 


Two Nikon D2Xs autofocus SLR cameras are 
nominally manifested for each mission. The Nikon 
D2Xs uses а 12-megapixel CMOS sensor that 
produces 10-MB compressed image files in a Nikon- 
proprietary .NEF raw format and can expose at ISOs 
from 100 to 3200. Тһе D2X provides automatic 
state-of-the-art metering for ambient light and flash 
exposure and is capable of exposures as brief as 
1/8000 of a second. The camera incorporates a "full 
information" LCD viewfinder display. 
Interchangeable autofocus lenses of various focal 
lengths ranging from 10.5mm up to 800mm are 
available. The camera permits continuous exposures 
at rates of up to 3 or 5 frames per second. It operates 
оп an 11.1 V dc rechargeable li-ION battery. Тһе 
Nikon flash (SB-800) operates on four AA batteries. 
The cameras are used primarily for in-cabin crew 
activities and experiments. They may also be used to 
document payload deployments апай Earth 
observations. 


The Nikon D2Xs can also be used for EVA missions. 
A special camera thermal cover and a custom 
eyepiece that assist the EVA crew with camera 
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operations are also manifested. The Nikon D2Xs 
EVA camera can also use a flash (SB800) in a 
pressurized aluminum housing. While any of the 
manifested camera bodies are capable of being used 
for EVA, only a few lenses have been qualified for the 
harsh EVA environment. A 400mm telephoto lens is 
flown for handheld photography of the shuttle 
external tank post-jettison. In addition to the 
handheld imagery, a Kodak DCS760 digital still 
camera is used for recording images of the 
EXTERNAL TANK (ET) from the right umbilical 
well right after ET separation. The camera 
automatically takes approximately 30 mapping 
images of the ET while the shuttle performs an 
11-second +X burn. For night launches, two Nikon 
58800 flashes are installed in the left umbilical well 
and are synchronized with the DCS760. Іп this 
configuration, the flash only fires every other shot; 
therefore, only 15 images are usable. Within 24 
hours of launch, the crew will downlink the images 
from this camera with the use of a laptop computer, a 
converter box, and cables via a connector on panel 
А13. 


Most of the photography conducted in the orbiter is 
with handheld equipment. With the exception of 
flash photography, many of the images and scenes the 
crew captures can be improved by using the multiuse 
brackets, clamps, and baseplate adapters. Twenty- 
two mounts throughout the flight deck, middeck, and 
airlock permit the crew to mount cameras and 
accessories. The baseplate adapters (crew installed) 
provide quick mounts in windows 9 and 10. The 
multiuse clamp is used on various structures to 
provide an attachment base for a multiuse arm. The 
multiuse arm is a modified commercial device that 
attaches to a camera and a wall mount or clamp. The 
arm permits universal pointing of the camera until 
the center “elbow” knob is tightened. When the knob 
is secure, the camera is held rigidly at the selected 
orientation (zero g). Multiuse equipment is also 
used to mount the camcorder and photo floodlight. 


Sighting Aids 


Sighting aids include all items used to aid the flight 
crew within and outside the crew compartment. The 
sighting aids include the crew optical alignment 
sight (COAS), binoculars, adjustable mirrors, and 
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spotlights. (The COAS is discussed in detail in 
Section 2.13.) Five models of binoculars are 
available for on-orbit use. Binocular models include 
the Zeiss 8X20, Fuji 10X40 gyro stabilized 
day/night, Fuji 14X40 gyro stabilized, Fuji 16X70, 
and the Zeiss 20X60 mechanically stabilized. The 
8X20 and 20X60 models are routinely flown on each 
mission. 


The spotlight is a high-intensity, handheld flashlight 
powered by a battery pack, consisting of five 1.2-volt, 
one-half D-size nickel-cadmium batteries. Тһе 
spotlight produces a 20,000-candlepower output 
with a continuous running time of 1.5 hours. The 
lamp is a 6-volt tungsten filament that cannot be 
replaced in flight. 


The high-intensity search light (HISL) is used in 
conjunction with the rangefinders during visual 
acquisition of satellites. It provides crewmembers 
with the capability to detect and maintain visual 
contact with a payload for effective rendezvous and 
stationkeeping at 700 to 1000 feet when on the dark 
side. The light is portable and has a stainless steel 
camera mounting rail on the handle that interfaces to 
the multiuse mounting brackets on the orbiter. The 
light is aimed out the aft, or overhead, windows of 
the flight deck. 


Window Shades and Filters 


Window shades and filters are provided for 
installation on the orbiter windows to minimize 
crewmember exposure to sunglare during 
ascent, entry, and orbital flight phases. 


The window shades are stowed in a 
compartmented bag attached to a mounting 
pallet on the starboard side of the aft middeck. 


To install the W1 through W6 window shades, 
the crewmember unrolls the shade (white 
surface outboard) over the window and mates 
the Velcro with the Velcro on the window 
frame. Removal of the shades is accomplished 
by just the reverse. Demate the Velcro, and roll 
the shade up as compactly as possible (blue 
surface visible). Insert into window shade holders 
and close the holders by mating Velcro together. 


Aft window shades are installed simply by 


placing the correct shade in the appropriate 
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window (reflective side outboard) and securing 
it to the mating Velcro on the window ledges. 


To remove a window shade from the window 
shade stowage container, the crewmember must 
unfasten the securing straps and pull the 
Velcro-restrained closure panel away from the 
desired stowage pouch. 


Interdeck light shades are provided to minimize 
light leakage between the flight deck and 
middeck during in-cabin photography. The light 
shade is attached with Velcro to the flight deck 
floor around the interdeck access. Adjustable 
louvers are provided to regulate the amount of 
light between the flight deck and the middeck. 


The side hatch viewport is the only optical- 
quality window on OV 103, 104, and 105. 
Unlike the 10 windows on the flight deck, the 
side hatch viewport does not provide protection 
from solar ultraviolet (UV) rays, which can 
cause serious injury in as little as 10 seconds. 
Therefore, a removable UV filter must be placed 
on the side hatch viewport for on-orbit 
operations. Тһе filter is held against the 
viewport by Velcro and is normally installed post 
insertion and removed during deorbit 
preparations. 


Shuttle Orbiter Medical System 


The shuttle orbiter medical system (SOMS) is 
required to provide medical care in-flight for 
minor illnesses and injuries. It also provides 
support for stabilizing severely injured or ill 
crewmembers until they are returned to Earth. 


The SOMS consists primarily of the medical kits 
that are organized into subpacks, which group 
similar items together that are used for specific 
procedures; e.g, Airway Subpacks. Each 
subpack contains pockets, sleeves, and elastic 
restraints that hold individual medications and 
medical supplies. The SOMS contains additional 
items, such as a sharps container, restraints, and 
a resuscitator. 


Most SOMS items are stowed together in a 
middeck locker. If the subpacks are required on 
orbit, they are unstowed and installed where 
needed using Velcro. The most frequently used 


2. SYSTEMS 
2.5 Crew Systems 


subpack is the Drug Subpack because it contains 
commonly used medications. 


The Airway Subpack contains emergency 
airway management equipment to maintain an 
open airway. Yellow labels with red lettering 
identify the items in this subpack as emergency 
items. Articles in the subpack include an oral 
airway, laryngoscope, and a СО» detector. 


The Drug Subpack contains oral, topical, and 
injectable medications. Oral medications are 
contained in Ziploc bags that are heat-sealed so 
that only a few pills may be dispersed at a time 
in microgravity. Commonly used medications are 
stowed on the spine of the subpack, giving easy 
access to them without having to unstow the entire 
subpack. There is also a medical data log and 
allergies list on the outside of the subpack. 


The Eye, Ear, Nose, and Throat (EENT) Subpack 
contains general diagnostic and therapeutic 
items used to treat EENT problems. The EENT 
Subpack includes items such аз dental 
medications and instruments, eye drops, nasal 
spray, and various medications and ointments. 


The Intravenous Administration (ГУ ADMIN) 
Subpack contains the equipment used to start 
an IV line to deliver medications and/or fluids 
to an Ш or injured crewmember. Skin 
preparation items, IV extension sets and 
butterfly needles, a blood pressure cuff, and one 
500 ml bag of saline are some of the items 
stowed in the IV ADMIN Subpack. 


The saline supply bag contains four 500-ml bags of 
saline. There are also two 250-ml bags inside the 
medical middeck locker. There ате a total of 3100 ml 
of saline flown on the shuttle. 


The Trauma Subpack contains items necessary 
to treat in-flight medical emergencies. This 
subpack contains equipment necessary for 
laceration closure and urinary catheterization, such 
as bandaging materials, gauze pads, sutures, 
and urinary catheters. 


А sharps container is provided for disposal of 
injectables and needles. The needle end of the sharp 
is inserted into the appropriate foam slot. 


The patient/rescuer restraint system is emergency 
hardware that is used if a crewmember becomes ill. 
The restraints are stored in the medical middeck 
locker. 
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The patient restraints secure the patient іп the 
mid-calf area and the chest area. The restraints can 
be easily tightened to fit the patient. The rescuer 
restraint wraps around the rescuer’s waist and has 
two extensions from the waist belt with pip pins on 
the ends to fasten into the locker latches. This allows 
the rescuer and patient to remain stationary. 


The SOMS also includes а resuscitator. The 
resuscitator consists of a mask with a retaining cap, a 
manually activated/demand regulated oxygen supply 
valve, a 6-foot hose, and a quick disconnect fitting. 


The  resuscitator can supply 100 percent 
supplemental oxygen in two ways: manual delivery 
by pressing the AMBU bag for unconscious patients, 
and on-demand flow for conscious patients. 


The resuscitator, upon unstowage, can be connected 
to the orbiter oxygen supply on the middeck 
connections on panels MO32M and MO69M and 
the flight deck connection on panel Сб. The 
resuscitator assembly is stored in a middeck locker 
adjacent to the medical middeck locker. 
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The Contaminant Cleanup Kit (CCK) is a 
multipurpose cleanup kit. Its purpose is to 
protect crewmembers from contamination by 
toxic and nontoxic particulates within the cabin 
environment. The CCK houses the shuttle 
emergency eyewash (SEE), which connects to 
the clean water supply in the shuttle galley to 
flush а crewmember's eyes in case of a chemical 
burn or smoke irritation of the eye. 


The Medical Accessory Kit (MAK) is a supplemental 
kit that is manifested on a mission-specific basis. The 
MAK provides additional stowage capability for 
crew-specific and/or mission-specific medications; for 
example, ice packs and ace bandages. Two are flown 
on each flight. 


The onboard Medical Checklist specifies the 
location of medications/equipment in the 
subpacks by using the name of the subpack, 
followed by the pocket number. For example, 
the laryngoscope is designated in the checklist 
as being stowed in Airway Subpack - 5. 
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Medical Locker Equipment and Locations 


The diagnostic equipment onboard and 
information from the flight crew allows 
diagnosis and treatment of injuries and illnesses 
through consultation with flight surgeons in 
Mission Control. 


Operational Bioinstrumentation System 


The operational bioinstrumentation system 
(OBS) provides an amplified electrocardiograph 
(ECG) analog signal from any crewmember 
aboard the orbiter to the avionics system, where 
the signal is converted to digital data and 
transmitted to the ground in real time or stored 
on tape for dump at a later time. On-orbit use is 
limited to contingency situations (only at the 
request of the flight surgeon) and is for IV use 
only. 
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The Electrode Attachment Kit (EAK) contains 
components to aid in the application of electrodes. 
The EAK includes wet wipes, stomaseals, overtapes, 
electrode paste, and a cue card to illustrate electrode 
placement. 


The OBS electrodes are attached to the skin with 
electrode paste to establish electrical contact. 
The electrode is composed of a plastic housing 
containing а non-polarizable pressed pellet. 
The housing is attached to the skin with double- 
sided adhesive tape, and the pellet contacts the 
skin. There are three electrodes on the harness, 
marked LC (lower chest), UC (upper chest), 
and G (ground). The three electrodes are connected 
to a signal conditioner that converts the ECG signal 
to digital data to be transferred to the ground. 


2.5-12 


The signal conditioner provides а zero- to 5-volt 
output and has an ON/OFF switch within the 
input plug, which is actuated when the IVA 
cable is plugged in. The unit has batteries that 
are not replaced in flight. 


The IVA cable connects to the signal 
conditioner. The other end of the IVA cable 
connects to the biomed cable, which then connects to 
one of the biomed input connectors located on 
panel M062M, A15, or АЛ. Rotary control 
switches on panel R10 provide circuits from the 
biomed outlets to the orbiter's network signal 
processor for downlink or recording. The two 
rotary switches on panel R10 are BIOMED 
CHANNEL 1 and CHANNEL 2. 
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Electrode Attachment Areas: Ground (G), 
Upper Chest (UC), and Lower Chest (LC) 
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Radiation Equipment 


The harmful biological effects of radiation must 
be minimized through mission planning based 
on calculated predictions and by monitoring 
dosage exposures. Preflight requirements in- 
clude a projection of mission radiation dosage, 
an assessment of the probability of solar flares 
during the mission, and a radiation exposure 
history of flight crewmembers. In-flight 
requirements mandate that each crewmember 
carry a passive dosimeter throughout the 
duration of the flight. In the event of a solar 
flare or other radiation contingency, the crew 
would be requested to retrieve and read out one 
or more of the active dosimeters. 
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The space shuttle radiation instrumentation system 
consists of both active and passive dosimeter devices. 
Active and passive radiation dosimetry devices 
include crew passive dosimeters (CPDs), passive 
radiation dosimeters (PRDs), a tissue equivalent 
proportional counter (TEPC), and a_ passive 
dosimeter kit (PDK). High-rate dosimeters (HRDs) 
are located inside the PDK. 


The flight crew's passive dosimeters use 
thermoluminescent dosimeter chips (TLDs); they 
must be worn by each U.S. crewmember throughout 
their flight, including EVAs. Тһе dosimeters 
measure the radiation dose to which a crewmember is 
exposed during the course of a mission and will be 
analyzed on the ground. 


Passive radiation dosimeters are placed in the crew 
compartment before launch by ground support 
personnel and removed after landing for laboratory 
analysis. The remaining dosimeters are stowed in 
the PDK located in a middeck locker. 


The TEPC is an active spectrometer that records the 
dose, dose rate, and the linear energy transfer (LET) 
spectrum as a function of time. The TEPC is 
required for most shuttle flights and nominally is 
stowed and deployed in the aft, starboard middeck 
area. Normal operations require minimal crew 
interaction. 


The unit is powered up, first at the power outlet, 
then at the switchbox located inside the TEPC 
assembly. This task normally is conducted on FD1. 
The unit is powered down on the last flight day. 


Periodically, the crew may be required to read the 
TEPC displays during certain radiation conditions, 
such as a solar proton event. 


The high rate dosimeter (HRD) is a COTS portable 
radiation detector used for detecting high-rate 
Neutron/Gamma radiation doses and Gamma 
radiation doses. The HRD uses a PMOS-FET for 
prompt photons and a PIN diode for prompt 
neutrons. The HRD may respond in a passive 
manner. Without any power applied to the 
instrument, the prompt neutrons will “damage” the 
PIN diode. When the HRD is turned ON, it will 
read the “damage” as a Dose. The HRD will remain 
stored in PDK in a locker unless the crew is 
instructed by the ground to read the instrument. 
The crew may be requested to do this in the event of a 
contingency situation. 
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The HRD shall measure and display radiation doses 
from 0-600 rad. The rad is a unit based on the 
amount of energy absorbed and is defined as 
any type of radiation that is deposited in the 
absorbing media. Radiation absorbed by 
humans is expressed in roentgen equivalent in 
man, or rems. The rem is determined by 
multiplying rads times a qualifying factor, 
which is a variable that depends on wavelength, 
source, etc. For low-inclination orbits (35° and 
lower), the qualifying factor is approximately 
equal to one; therefore, the тет is 
approximately equal to the rad. In space 
transportation system flights, the doses received 
have ranged from 0.05 to 0.07 rem, which is well 
below flight crew exposure limits. 


Air Sampling System 


There are two modes of air sampling onboard. The 
grab sample container (GSC) is an air sampling 
system that provides a method for obtaining 
cabin atmosphere samples to allow postflight 
analysis of the gas environment within the crew 
module. The GSC is stowed in a modular locker 
for ascent, unstowed for sampling, and 
restowed for entry. 


The GSC is an evacuated steel cylinder that is fitted 
with a valve operated by the valve knob. A screw 
cap, which covers the air inlet to prevent dust from 
contaminating the air sample, is tethered to the 
valve. 


Two GSCs nominally are manifested for each flight. 
One is to be used during a contingency situation, 
such as fire or smoke in the cabin, and the other is 
used nominally during deorbit prep. 
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Grab Sample Container 


The compound specific analyzer - combustion 
products (CSA-CP) is used for real-time analysis 
of three constituents (carbon monoxide (CO), 
hydrogen cyanide (HCN), and hydrogen 
chloride (HCl). Nominally, the CSA-CP is 
unstowed on FD1 as an easy activity. The 
sensors are evaluated and can be zeroed 
on-orbit if out of spec. The CSA-CP is then 
stowed temporarily at a crew selected location. The 
crew should call MCC with the location. 
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CSA-CP Monitor 
CSA-CP Pump 
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Description 


The DPS, consisting of various hardware 
components апа self-contained software, 
provides the entire shuttle with computerized 
monitoring and control. DPS functions are: 


® Support the guidance, navigation, and 
control of the vehicle, including calcula- 
tions of trajectories, S5ME burn data, 
and vehicle attitude control data. 
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е Monitor and control vehicle subsystems, 
such as the electrical power system and 
the environmental control апа life 
support system. 


e Process vehicle data for the flight crew 
and for transmission to the ground, and 
allow ground control of some vehicle 
systems via transmitted commands. 


e Check data transmission errors and 
crew control input errors; support 
annun-ciation of vehicle system failures 
and out-of-tolerance system conditions. 


® Support payloads with flight crew/ 
software interface for activation, deploy- 
ment, deactivation, and retrieval. 


e Process rendezvous, tracking, and data 
transmissions between payloads and the 
ground. 


The DPS hardware consists of five general- 
purpose computers (GPCs), two modular 
memory units (MMUs) for large-volume bulk 
storage, and a network of serial digital data 
buses to accommodate the data traffic between 
the GPCs and vehicle systems. The DPS also in- 
cludes 20 orbiter and 4 SRB multiplexers/ 
demultiplexers (MDMs) to convert and format 
data from the various vehicle systems, 3 SSME 
interface units to command the SSMEs, a 
multifunction electronic display system (MEDS) 
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used by the flight crew to monitor and control 
the vehicle and payload systems, 2 data bus 
isolation amplifiers to interface with the ground 
support equipment/launch processing system 
and the SRBs, 2 master events controllers, and a 
master timing unit. 


DPS software accommodates almost every 
aspect of space shuttle operations, including 
orbiter checkout, prelaunch and final count- 
down for launch, turnaround activities, control 
and monitoring during launch, ascent, on-orbit 
activities, entry, and landing, and aborts or 
other contingency mission phases. А multi- 
computer mode is used for the critical phases of 
the mission, such as launch, ascent, orbit, entry, 
landing, and aborts. 


General Purpose Computers (GPCs) 


The orbiter has five identical IBM АР-1015 
GPCs. The СРС receive and transmit data to 
and from interfacing hardware via the data bus 
network. GPCs also contain the software that 
provides the main on-board data processing 
capability. Up to four of the systems may run 
identical software. The fifth system runs differ- 
ent software, programmed by a different com- 
pany, designed to take control of the vehicle if 
an error in the primary software or other 
multiple failures cause a loss of vehicle control. 
The software utilized by the four primary GPCs 
is referred to as PASS (primary avionics soft- 
ware system); the fifth GPC is referred to as BFS 
(backup flight system). 
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GPCs 1 and 4 are located in forward middeck 
avionics bay 1, GPCs 2 and 5 are located in 
forward middeck avionics bay 2, and GPC 3 is 
located in aft middeck avionics bay 3. The 
GPCs receive forced-air cooling from ап 
avionics bay fan. (There are two fans in each 
avionics bay, but only one is powered at a time.) 


CAUTION 


If both fans in an avionics bay fail, the 
computers will overheat within 25 minutes 
(at 14.7 psi cabin pressure) or 17 minutes 


(at 10.2 psi) after which their operation 
cannot be relied upon. An operating GPC 
may or may not survive for up to an 


additional 30 minutes 
certifiable thermal limits. 


beyond the 


Each GPC consists of a central processing unit 
(CPU) and an input/output processor (IOP) 
stored in one avionics box. The boxes are 19.55 
inches long, 7.62 inches high, and 10.2 inches 
wide; they weigh approximately 60 pounds. 
The main memory of each GPC is volatile (the 
software is not retained if power is interrupted), 
but a battery pack preserves software contents 
when the GPC is powered off. The memory 
capacity of the GPCs is 256 К full-words, but 
only the lower 128 k full-words are normally 
used for software processing. 


The CPU controls access to GPC main memory 
for data storage and software execution and 
executes instructions to control vehicle systems 
and manipulate data. 


The IOP formats and transmits commands to 
the vehicle systems, receives and validates 
response data transmissions from the vehicle 
systems, and maintains the status of interfaces 
with the CPU and the other GPCs. 


The 24 data buses are connected to each IOP by 
bus control elements (BCEs) that receive, 
convert, and validate serial data in response to 
requests for available data to be transmitted or 
received from vehicle hardware. 


For timing, each GPC contains an oscillator that 
sends signals to internal components to regulate 
operations. The GPC also uses the oscillator to 
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maintain an internal clock to keep track of 
Greenwich mean time (GMT) and mission 
elapsed time (MET) as a backup to the timing 
signal from the master timing unit (MTU). 


Each GPC contains a watchdog timer. The 
watchdog timer is an incrementing clock 
register in the GPC that is reset about once 
every second by a signal from the CPU. If the 
register ever overflows, then a problem exists 
and is annunciated by a self-fail indication from 
that GPC. The PASS set does not utilize this 
hardware feature since it operates in 
synchronization with each of its GPCs to ensure 
proper functioning. Since the BFS operates 
essentially standalone relative to the PASS set 
synchronization, the BFS mechanization does 
utilize the watchdog timer function to serve as a 
check on its operation. 


The PASS СРС use a hardware "voter" to 
monitor discrete inputs from the other GPCs. 
Should a GPC receive a fail vote from two or 
more of the other GPCs, it will cause the GPC to 
annunciate a self-fail indication that also causes 
the GPC to inhibit any fail votes of its own 
against the other GPCs. 


GPC Controls 


The GENERAL PURPOSE COMPUTER 
hardware controls are located on panel O6. 
Each of the five GPCs reads the position of its 
corresponding OUTPUT and MODE switches 
and INITIAL PROGRAM LOAD pushbuttons 
from discrete input lines that go directly to the 
GPC. Each GPC has OUTPUT and MODE 
talkback indicators on panel O6 that are driven 
by GPC output discretes. 


Each GPC has a GENERAL PURPOSE 
COMPUTER POWER switch on panel O6. 
Positioning a switch to ON enables power from 
three essential buses, ESS 1BC, 2CA, and 3AB. 
The essential bus power controls remote power 
controller (RPCs), which permit main bus DC 
power from the three main buses (MN A, MN 
B, and MN C) to power the GPC. There are 
three RPCs for each GPC; thus, any GPC will 
function normally, even if two main or essential 
buses are lost. Each computer uses 560 watts of 
power. 
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Each GENERAL PURPOSE COMPUTER OUT- 
PUT switch on panel O6 is a guarded switch 
with BACKUP, NORMAL, and TERMINATE 
positions. The switch provides a hardware 
override to the GPC that precludes that GPC 
from outputting on the flight-critical buses. The 
switches for the PASS GNC GPCs аге 
positioned to NORMAL, which permits them to 
output. The backup flight system switch (GPC 
5) is positioned to BACKUP, which precludes it 
from outputting until it is engaged. The switch 
for a GPC designated on-orbit to be a systems 
management (SM) computer is positioned to 
TERMINATE, since the GPC is not to command 
anything on the flight-critical buses. 
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GENERAL PURPOSE COMPUTER 
Hardware Controls 


The talkback indicator above each OUTPUT 
switch on panel O6 indicates gray if that GPC 
output is enabled and barberpole if it is not. 


Each GPC receives RUN, STBY, or HALT 
discrete inputs from its MODE switch on panel 
O6, which determines whether that GPC can 
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process software. The MODE switch is lever- 
locked in the RUN position. The HALT position 
initiates a hardware-controlled state in which 
no software can be executed. A GPC that fails 
to synchronize with others is either powered 
OFF or moded to HALT as soon as possible to 
prevent the failed computer from outputting 
erroneous commands. Тһе talkback indicator 
above the MODE switch for that GPC indicates 
barberpole when that computer is in HALT. 


In STBY, a GPC is also in a state in which no 
PASS software can be executed, but it is in a 
software-controlled state. Тһе STBY mode 
allows an orderly startup or shutdown of 
processing. It is necessary, as a matter of proce- 
dure, for a PASS СРС that is shifting from RUN 
to HALT or vice versa to be temporarily (more 
than 3 seconds) in the STBY mode before going 
to the next state. The STBY mode allows for an 
orderly software cleanup and allows a GPC to 
be correctly initialized (when reactivated) 
without an initial program load. If a GPC is 
moded to RUN or HALT without pausing in 
STBY, it may not perform its functions correctly. 
There is no STBY indication on the talkback 
indicator above the MODE switch. 


The RUN position permits a GPC to support its 
normal processing of all active software and 
assigned vehicle operations. | Whenever а 
computer is moded from STBY to RUN, it 
initializes itself to a state in which only system 
software is processed (called OPS 0). If a GPC is 
in another operational sequence (OPS) before 
being moded out of RUN, that software still 
resides in main memory; however, it will not 
begin processing until that OPS is restarted by 
flight crew keyboard entry. The MODE 
talkback indicator always reads RUN when that 
GPC switch is in RUN, and no failures exist. 


Placing the backup flight system GPC in STBY 
does not stop BFS software processing or 
preclude BFS engagement; it only prevents the 
BFS from commanding the payload buses used 
by BFS systems management software. 


The PASS GPC/BUS STATUS display (DISP 6) 
indicates the current mode of each PASS GPC in 
the common set. The display does not 
differentiate between STBY and HALT; only 
RUN or HALT is displayed (GPC MODE). 
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GPC/BUS STATUS Display (DISP 6) 


The INITIAL PROGRAM LOAD pushbutton for 
a GPC on panel 06 activates the initial program 
load command discrete input when depressed. 
When the input is received, that GPC initiates 
an initial program load (IPL) from the MMU 
specified by the IPL SOURCE switch on panel 
Об. The talkback indicator above the MODE 
switch for that GPC briefly indicates ІРІ, then 
changes back to barberpole. 


During non-critical periods in orbit, only one or 
two GPCs are used for GNC tasks, and another 
is used for systems management and payload 
operations. 


A GPC on orbit can also be "freeze-dried"; that 
is, it can be loaded with the software for a 
particular memory configuration and then 
moded to HALT. Before an OPS transition to 
the loaded memory configuration, the freeze- 
dried GPC can be moded back to RUN and the 
appropriate OPS requested. 


NOTE 


Because all BFS software is loaded into 
the BFS GPC at the same time, the BFS 
GPC is sometimes referred to as being 
freeze-dried on orbit when it is placed in 
HALT. The BFS GPC can be moded to 
RUN prior to entry and will begin 
processing entry software following the 
OPS 3 request without having to access a 
modular memory unit. The term freeze- 
dry or freeze-dried is most often used 
with respect to the PASS GPCs. 
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GPC Modes of Operation 


GPC modes of operation are redundant set, 
common set, and simplex. Redundant set 
operations refer to the mode in which two or 
more GPCs are concurrently receiving the same 
inputs, executing the same GNC software, and 
producing the same outputs. This mode uses a 
maximum amount of intercomputer communi- 
cations, and the GPCs must maintain a high 
level of synchronization (called redundant set 
synchronization). 


During redundant set operations, each GPC 
outputs only certain portions of its total 
software output to its interfacing hardware. 
Therefore, although each GPC "thinks" it is 
performing all its operations, only the GPC 
responsible for supporting a specific group of 
hardware will be able to actually transmit its 
data and commands. The redundant set GPCs 
compare all calculations to ensure that 
individual outputs are the same. 


Common set operations occur when two or more 
GPCs communicate with one another while they 
are performing their individual tasks. They do 
not have to be performing the same major 
function (although they can be), but they do 
maintain common set synchronization. Any 
GPC operating as a member of the redundant set 
is also a member of the common set. 


A simplex GPC is in RUN, but not a member of 
the redundant set. Systems management and 
payload major functions are always processed 
in a simplex GPC. 


GPCs running together іп the same GNC OPS 
are part of a redundant set performing identical 
tasks from the same inputs and producing 
identical outputs. Therefore, any data bus 
assigned to a commanding GNC GPC (except 
the instrumentation buses because each GPC 
has only one dedicated bus connected to it) is 
heard by all members of the redundant set. 
These transmissions include all keyboard inputs 
and mass memory transactions, as well as 
flight-critical data. If one or more GPCs in the 
redundant set fail, the remaining computers can 
continue operating in СМС. Each СРС 
performs about 1.2 million operations per 
second during critical phases. 
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Each computer in a redundant set operates in 
synchronized steps and cross-checks results of 
processing hundreds of times per second. 
Synchronization refers to the software scheme 
used to ensure simultaneous intercomputer 
communications of necessary GPC status 
information among the PASS computers. If a 
GPC operating in a redundant set fails to meet 
any redundant synchronization point, the 
remaining computers will immediately vote it 
out of the redundant set. If a GPC has a 
problem with one of its multiplexer interface 
adapter receivers during two successive reads 
of response data, or does not receive data while 
other members of the redundant set do receive 
data, the GPC with the problem will fail-to- 
sync. 


GPC Failure Indications 


GPC failure votes are annunciated in a number 
of ways. Each GPC has discrete output lines for 
fail votes against each of the other GPCs that go 
to the other GPCs and the GPC status matrix. A 
GPC FAIL detection will cause a class 2 GPC 
fault message with illumination of the MASTER 
ALARM. Error indications will be displayed on 
DISP 18 GNC SYS SUMM 1 and DISP 6 
GPC/BUS STATUS displays. 


The GPC STATUS matrix (sometimes referred 
to as the GPC fail CAM) on panel O1 is a 5-by-5 
matrix of lights. Each light corresponds to a 
GPC's fail vote against another GPC or itself. 
For example, if GPC 2 sends out a failure vote 
against GPC 3, the second white light in the 
third column is illuminated. The off-diagonal 
votes are votes against other GPCs. The yellow 
diagonal lights from upper left to lower right 
are self-failure votes. Whenever a GPC receives 
two or more failure votes from other GPCs, it 
illuminates its own yellow light and resets any 
failure votes that it made against other GPCs 
(any white lights in its row are extinguished). 
Any time a yellow matrix light is illuminated, 
the GPC caution and warning light on panel F7 
is illuminated, in addition to MASTER ALARM 
illumination, and a GPC fault message is 
displayed on the DPS displays. 
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DPS Parameters on GNC SYS SUMM 11 
Display (DISP 18) 
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GPC MEMORY DUMP Switch on 
Panel M042F 


А failed GPC's memory contents сап Бе 
dumped by powering ON, switching the 
computer to TERMINATE and HALT, and then 
selecting the number of the failed GPC on the 
GPC MEMORY DUMP rotary switch on panel 
M042F. The СРС is then moded to STBY to 
start the dump. After 2 to 8 minutes, the dump 
is stopped by moding the GPC to HALT and the 
output to NORM. This process is referred to as 
а  hardware-initiated, standalone memory 
(HISAM) GPC memory dump. 
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GPCs and vehicle systems. The network has 
seven groups that perform specific functions: 


1. Flight-critical (FC) data buses that tie 
the GPCs to the FC MDMs, integrated 
display processors (IDPs), head-up 
displays (HUDs), engine interface 
units (EIUs), and master events 
controllers (МЕС). 


2. Payload data buses that tie the GPCs 
to the payload MDMs апа the 
payload data interleaver (PDI), and 


possibly mission-dependent | flex 
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3. Launch data buses that tie the GPCs to 
ground support equipment, launch 
forward, launch aft, launch mid, and 
SRB MDMs, and the manipulator 
controller interface unit (MCIU) used 
by the remote manipulator system. 


4. Mass memory data buses for GPC/ 
MMU transactions. 


5. Display/keyboard (DK) data buses 
for GPC/IDP transactions. 


6. Instrumentation/ PCMMU (ІР) 
buses. 


data 


7. Intercomputer communication (ICC) 
data buses. 


Although all data buses in each group except 
the instrumentation/ PCMMU buses are con- 
nected to all five GPCs, only one GPC at a time 
transmits commands over each bus. However, 
several GPCs may receive data from the same 
bus simultaneously. 


Each data bus, with the exception of the inter- 
computer communication data buses, is 
bidirectional; that is, data can flow in either 
direction. The intercomputer communication 
data bus traffic flows in only one direction (a 
PASS software constraint, not a hardware 
restriction). 


Flight-Critical Data Buses 


There are eight FC data buses directed into 
groups of two, referred to as an FC string. Each 
FC string can be commanded by a different 
GPC. Multiple units of each type of GNC 
hardware are wired to a different MDM and 
flight-critical bus. ЕСІ, 2, 3, and 4 connect the 
GPCs with the four flight-critical forward (FF) 
MDMs;, the four flight-critical aft (FA) МОМ, 
the four integrated display processors, and the 
two head-up displays. The other four, ЕС5, 6, 7, 
and 8, connect the GPCs to the same four FF 
MDMs, the same four FA МОМ», the two 
master events controllers, and the three main 
engine interface units. 


A string is composed of two FC data buses: one 
from the first group (ЕСТ, 2, 3, or 4) and one 
from the second group (ЕС5, 6, 7, or 8). Vehicle 
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hardware is segmented into these groups to 
facilitate GPC command of these components 
for redundancy, to allow for nominal mission 
operations in the event of a loss of one string 
caused by a GPC or MDM failure, and to allow 
for safe return to Earth in the event of the loss of 
a second string. 


String 1 consists of FC data buses 1 and 5, 
MDMs ЕГІ and FA1 and their hard-wired hard- 
ware, controls, and displays, the three engine 
interface units, the two master events control- 
lers, the four integrated display processors, and 
head-up display 1. This distribution of hard- 
ware is fixed and cannot be changed. The other 
three strings are defined in a similar manner. 


During ascent and entry, when there are four 
PASS СМС GPCs in the redundant set, each is 
assigned a different string to maximize redun- 
dancy. АП flight-critical hardware units are 
redundant, and the redundant units are on dif- 
ferent strings. The string concept provides 
failure protection during dynamic phases by 
allowing exclusive command of a specific group 
of vehicle hardware by one GPC, which can be 
transferred to another GPC in case of failure. 
АП or part of one string can be lost, and all 
avionics functions will still be retained through 
the other strings. 


Flight-critical data bus 1 (FC1) 
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With four PASS GNC GPCs in а redundant set, 
each GPC is responsible for issuing commands 
over the string assigned to it; that is, it is the 
commander of that string. The other GNC 
GPCs will monitor or listen on this string. 
When the string's commanding GPC sends a 
request for data to the hardware on the string, 
all the other GNC GPCs will hear and receive 
the same data coming back on the string. This 
transaction (one commanding GPC and 
multiple listening GPCs) is occurring in parallel 
with the other three strings. Therefore, all GNC 
GPCs will get a copy of all of the data from all 
four strings. Once all the data are received from 
the string, the GPCs then agree (or disagree) 
that the data are consistent. 


Payload Data Buses 


Two payload data buses interface the five GPCs 
with the two payload MDMs (also called 
payload forward MDMs), which interface with 
orbiter systems and payloads. A PDI is 
connected to payload data bus 1. Additionally, 
on some flights, one or two flex MDMs and/or 
sequence control assemblies connect the 
payload data buses to communicate with other 
payload equipment. 


Each payload MDM is connected to two 
payload data buses.  Safety-critical payload 
status parameters may be hard-wired; then 
these parameters and others can be recorded as 
part of the vehicle's system management, which 
is transmitted and received over two payload 
buses. To accommodate the various forms of 
payload data, the PDI integrates payload data 
for transmission to ground telemetry. PDI 
configuration commands and status monitoring 
are accomplished via payload data bus 1. 


Launch Data Buses 


Two launch data buses are used primarily for 
ground checkout and launch phase activities. 
They connect the five GPCs with the ground 
support equipment/launch processing system, 
the launch forward (LF1), launch mid (LM1), 
and launch aft (LA1) MDMs aboard the orbiter, 
and the two left and right SRB MDMs (LL1, 
LL2, LR1, and LR2). Launch data bus 1 is used 
on orbit for interface with the remote 
manipulator system controller by the SM GPC. 
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Mass Memory Data Buses 


Each of two MMUs interfaces with its data bus 
via a multiplexer interface adapter, which 
functions just like the ones in the GPCs. Each 
data bus is connected to all five GPCs. Each 
MMU is connected to only one mass memory 
data bus. 


In addition, each MMU has a separate discrete 
line called the "ready discrete" that goes to each 
of the GPCs. If the discrete is on, it tells the 
GPC the modular memory unit is ready for a 
transaction. When the discrete is off, the MMU 
is either busy with another transaction or is 
powered off. 


Note that all ММО operations and 
transmissions to the GPCs are on an on-demand 
basis only. There is no insight into the state of 
the MMU (other than the ready discrete) unless 
a specific transaction is requested. 


Display/Keyboard Data Buses 


The four display/keyboard (DK) data buses, 
one for each IDP, are connected to each of the 
five GPCs. The computer in command of a 
particular display/ keyboard data bus is a 
function of the current MAJOR FUNC switch 
setting of the associated IDP, current memory 
configuration, GPC/CRT keyboard entries, and 
the position of the backup flight control (BFC) 
CRT switches. (These topics are discussed in 
more detail under "Operations.") 


Instrumentation/Pulse-Code Modulation 
Master Unit (PCMMU) Buses 


The five instrumentation/PCMMU data buses 
are unique in that each GPC has its own 
individual data bus to two PCMMUs. All the 
other data buses interface with every GPC. 


Flight controllers monitor the status of the 
vehicle's onboard systems through data 
transmissions from the vehicle to the ground. 
These transmissions, called downlink, include 
GPC-collected data, payload data, instrumenta- 
tion data, and onboard voice. The GPC-col- 
lected data, called downlist, includes a set of 
parameters chosen before flight for each 
mission phase. 
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The system software in each GPC assimilates 
the specified GNC, systems management, 
payload, or DPS data according to the 
premission-defined format for inclusion in the 
downlist. Each GPC is physically capable of 
transmitting its downlist to the current active 
PCMMU over its dedicated 
instrumentation/ PCMMU data bus. Only one 
PCMMU is powered at a time. It interleaves the 
downlist data from the different GPCs with the 
instrumentation and payload data according to 
the telemetry format load programmed in the 
PCMMU. Тһе resulting composite data set, 
called the operational downlink, is transmitted 
to one of two network signal processors (ISPs). 
Only one NSP is powered at a time. In the NSP, 
the operational downlink is combined with 
onboard recorded voice for transmission to the 
ground. The S-band апа Ku-band 
communications systems transmit the data 
either to the space flight tracking and data 
network remote site ground stations or through 
the Tracking and Data Relay Satellite (TDRS) 
system to Mission Control. 


Uplink is how ground commands originating in 
Mission Control are formatted, generated, and 
transmitted to the orbiter for validation, 
processing, and eventual execution by onboard 
software. This capability allows ground 
systems to control data processing, change 
modes in orbiter hardware, and store or change 
software in GPC memory and mass memory. 


From MCC consoles, flight controllers issue 
commands and request uplink. The command 
requests are formatted into a command load for 
transmission to the orbiter either by the STDN 
sites or by the TDRS system. The S-band or Ku- 
band transponder receivers aboard the orbiter 
send the commands to the active NSP. The NSP 
validates the commands and, when they are 
requested by the GPCs through a flight-critical 
MDM, sends them on to the GPC. The GPCs 
also validate the commands before executing 
them. Those GPCs listening directly to the 
flight-critical data buses then forward uplink 
commands for those GPCs not listening to the 
FC buses over the intercomputer commu- 
nication data buses. 


Ihe PCMMU also contains a programmable 
read-only memory for accessing subsystem 
data, a random-access memory in which to store 
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data, and a memory in which GPC data are 
stored for incorporation into the downlink. 


To prevent the uplink of spurious commands 
from somewhere other than Mission Control, 
the flight crew can control when the GPCs 
accept uplink commands, and when uplink is 
blocked. The GPC BLOCK position of the 
UPLINK switch on panel C3 inhibits uplink 
commands during ascent and entry when the 
orbiter is not over a ground station or іп TDRS 
coverage. 


MASTER 
UPLINK MADS POWER 
NSP BLOCK ON 


г СА 
© [а 


ш 


= 
© 


(6131 


ENABLE 
SAF ING 


3 
NORM 


UPLINK Switch on Panel C3 
Intercomputer Communication Data Buses 


There are five intercomputer communication 
(ICC) data buses. The following information is 
exchanged over these buses for proper DPS 
operation: input/output errors, fault messages, 
GPC status matrix data, IDP major function 
switch settings, GPC/CRT keyboard entries, 
resident GPC memory configuration, memory 
configuration table, operational sequences, 
master timing unit time, internal GPC time, 
system-level display information, uplink data, 
and state vectors. 


All GPCs processing PASS software exchange 
status information over the ICC data buses. 
During launch, ascent, and entry, GPCs 1, 2, 3, 
and 4 are usually assigned to perform GNC 
tasks, operating as a redundant set, with GPC 5 
as the backup flight system. Each of the PASS 
GPCs acts as a commander of a given ICC data 
bus and initiates all data bus transactions on 
that data bus. 
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Тһе four PASS GPCs аге loaded with the same 
software. Interconnecting the four ICC buses to 
the four PASS GPCs allows each GPC access to 
the status of data received or transmitted by the 
other GPCs so that identical results among the 
four PASS GPCs can be verified. Each ICC bus 
is assigned to one of the four PASS GPCs in the 
command mode, and the remaining GPCs 
operate in the listen mode for the bus. Each 
GPC can receive data from the other three 
GPCs, pass data to the others, and perform any 
other tasks required to operate the redundant set. 


Multiplexers/Demultiplexers (MDMs) 


The MDMs convert and format (demultiplex) 
serial digital GPC commands into separate 
parallel discrete, digital, and analog commands 
for various vehicle hardware systems. The 
MDMs also convert and format (multiplex) the 
discrete, digital, and analog data from vehicle 
systems into serial digital data for transmission 
to the GPCs. Each MDM has two redundant 
multiplexer interface adapters (MIAs), each 
connected to a separate data bus. The МОМ» 
other functional interface is its connection to the 
appropriate vehicle system hardware by hard- 
wired lines. 


There are 20 MDMs aboard the orbiter; 13 are 
part of the DPS, connected directly to the GPCs 
and named and numbered according to their 
location in the vehicle and hardware interface. 
The remaining seven MDMs are part of the 
vehicle instrumentation system and send 
vehicle instrumentation data to the PCMMUs. 
(They are termed operational instrumentation 
(OI) MDMs.) 


The DPS MDMs consist of flight-critical forward 
(FF) MDMs 1 through 4, flight-critical aft (FA) 
MDMs 1 through 4, payload (PL) MDMs 1 and 
2, and GSE/LPS launch forward (LF1), launch 
mid (LM1), and launch aft (LA1). One or two 
flex MDMs (FMDMs) may also be connected to 
the PL data buses, depending on the payload 
needs for a particular flight. 


Of the seven operational instrumentation 
MDMs, four are located forward (OF1, OF2, 
OF3, and OF4), and three are located aft (OA1, 
OA2, and OA3). 
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Also recall, there are four SRB МОМ; i.e., SRB 
launch left (LL) MDMs 1 and 2 and launch right 
(LR) MDMs 1 and 2. 


The system software in the redundant set GPC 
activates a GNC executive program and issues 
commands to authorized buses and MDMs to 
request a set of input data. Each MDM receives 
the command from the GPC assigned to 
command it, acquires the requested data from 
the GNC hardware wired to it, and sends the 
data to the GPCs. 


Each FC data bus is connected to a flight 
forward and flight aft MDM. Each MDM has 
two MIAs, or ports, and each port has a channel 
through which the GPCs can communicate with 
an MDM; however, the GPCs can interface on 
the FC data buses with only one MIA port at a 
time. Port moding is the software method used 
to control the MIA port that is active in an 
MDM. Initially, these MDMs operate with port 
1; if a failure occurs in port 1, the flight crew can 
select port 2. Since port moding involves a pair 
of buses, both MDMs must be port moded at 
the same time. The control of all other units 
connected to the affected data buses 15 
unaffected by port moding. Port moding is a 
software-only process and does not involve any 
hardware changes. 
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Payload data bus 1 is connected to the primary 
MIA port of payload MDM 1, and payload data 
bus 2 is connected to the primary port of 
payload MDM 2. Payload data bus 1 is 
connected to the secondary MIA port of payload 
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MDM 2, and payload data bus 2 is connected to 
the secondary port of payload MDM 1. Which 
bus is used to communicate with each MDM is 
controlled by port moding. 


The two launch data buses are also connected to 
dual launch MDM multiplexer interface adapter 
ports. The flight crew cannot switch these 
ports; however, if an input/output error is 
detected on LF1 or LA1 during prelaunch, an 
automatic switchover occurs. 


The hardware controls for the MDMs are the 
MDM PL1, PL2, PL3, FLT CRIT AFT, and FLT 
CRIT FWD power switches on panel Об. These 
ON/OFF switches provide or remove power for 
the four aft and four forward flight-critical 
MDMs and PL1 and PL2 MDMs. Тһе PL3 
switch is unwired and is not used. There are no 
flight crew controls for the SRB MDMs. 


Each MDM is redundantly powered by two 
main buses. The power switches control bus 
power for activation of a remote power 
controller (RPC) for each main power bus to an 
MDM. The main buses power separate power 
supplies in the MDM. Loss of either the main 
bus or MDM power supply does not cause a 
loss of function because each power supply 
powers both channels in the MDM. Turning off 
power to an MDM resets all the discrete and 
analog command interfaces to subsystems. 


The SRB MDMs receive power through SRB 
buses A and В; they are tied to the orbiter main 
buses and are controlled by the master events 
controller circuitry. The launch forward, mid, 
and aft MDMs receive their power through the 
preflight test buses. 


The FF, PL, LF, and LM MDMs are located in 
the forward avionics bays and are cooled by 
water coolant loop cold plates. LA and FA 
MDMs are in the aft avionics bays and are 
cooled by Freon coolant loop cold plates. 
MDMs LL1, LL2, LR1, and LR2 are located in 
the SRBs and are cooled by passive cold plates. 


Module (or card) configuration in an MDM was 
dictated by the hardware components to be 
accessed by that type of MDM. A flight-critical 
forward and aft MDM are not interchangeable. 
However, flight-critical MDMs of the same type 
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may be interchanged with another and the 
payload MDMs may be interchanged. 


Each MDM is 13 by 11 by 7 inches and weighs 
about 38.5 pounds. MDMs use less than 80 
watts of power. 


Enhanced MDMs (EMDMs) were installed in 
OV-105. EMDMs will be installed in the other 
vehicles only as MDMs require replacement 
(currently both types are on Atlantis). The 
presence of EMDMs is transparent to the crew 
except in the case of an MDM OUTPUT 
message. With MDMs, the message means 
there is a problem with an MDM oraGPC. An 
MDM OUTPUT message with EMDMs means it 
is most likely a GPC problem. Crews flying 
with a combination of MDMs and EMDMs will 
receive assistance from flight controllers in 
interpreting an MDM OUTPUT message. 


— МТ ВИТ АРТ ——_____, 
FAL FAC FA РАЈ 


Fra FF4 


ом 


ЖАУ 
(==) 


ТР 


DFF 


1128.cnv 


MDM Power Switches on Panel 06 


Modular Memory Units 


There are two modular memory units (MMUs) 
aboard the orbiter. A modular memory unit 
consists of a solid state recorder (55К) and a 
solid state mass memory (55ММ) storage device 
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for GPC software апа orbiter systems data. For 
more information on the SSR, see section 2.4. 
For simplicity, MMU in this section will refer to 
the SSMM functions to the DPS. 


Computing functions for all mission phases 
require approximately 600,000 half-words of 
computer memory. The orbiter GPCs are 
loaded with different memory configurations 
from the MMUs. In this way, software can be 
stored in MMUs and loaded into the GPCs 
when actually needed. 


To fit the required software into the available 
GPC memory space, programs are subdivided 
into eight memory configurations correspond- 
ing to functions executed during specific flight 
and checkout phases. Thus, in addition to the 
central memory in the GPCs themselves, 128 
Mbit of information can be stored in each of the 
two MMUs. Critical programs and data are 
loaded in both MMUs and protected from 
erasure. 


The principal function of the MMU, besides 
storing the basic flight software, is to store 
background formats and code for certain 
displays and the checkpoints that are written 
periodically to save selected data in case the 
systems management GPC fails. 


Each MMU interfaces with its mass memory 
data bus through MIAs that function like the 
ones in the GPCs. Each mass memory data bus 
is connected to all five computers; however, 
each MMU is connected to only one mass 
memory data bus. All MMU operations are on 
an on-demand basis only. 


The power switches are located on panel O14 
for MMU 1 and panel O15 for MMU 2. The 
MMU 1 switch on panel O14 positioned to ON 
allows control bus power to activate an RPC, 
which allows MNA power to MMU 1. The 
MMU 2 switch on panel O15 positioned to ON 
operates in a similar manner with MNB power. 
An modular memory unit uses 83 watts of 
power, with the SSMM consuming 9 of those 
watts. 


MMU 1 is located in crew compartment 
middeck avionics bay 1 and MMU 2 is in 
avionics bay 2. Each unit is cooled by water 
coolant loop cold plates. Each MMU is 7.7 
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inches high, 12 inches wide, 20 inches long and 
weighs 40 pounds. 
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Multifunction Electronic Display System 
(MEDS) 


MEDS allows onboard monitoring of orbiter 
systems, computer software processing, and 
manual control for flight crew data and 
software manipulation. 


MEDS has four types of hardware: four IDPs, 
11 multifunction display units (MDUs), 4 
analog-to-digital converters (ADCs), and 3 
keyboard units, which together communicate 
with the GPCs over the DK data buses. 
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The system provides almost immediate 
response to flight crew inquiries through 


displays, graphs, trajectory plots, and 
predictions about flight progress. The crew 
controls vehicle system operation with 


keyboards in conjunction with the IDPs. The 
flight crew can alter the system configuration, 
change data or instructions in GPC main 
memory, change memory configurations 
corresponding to different mission phases, 
respond to error messages and alarms, request 
special programs to perform specific tasks, run 
through operational sequences for each mission 
phase, and request specific displays. 


Integrated Display Processor (IDP) 


The IDP is the interface between MEDS and the 
GPCs. It formats data from the GPCs and 
ADCs for display on the MDUs. Also, it accepts 
operator inputs from switches, edgekeys, and 
keyboards. In addition to all of these functions, 
the IDP monitors its own status and the status 
of other MEDS LRUs. It has both hardware 
built-in test equipment (BITE) and software self- 
tests. 


On the GPC side, each IDP is connected to 
flight-critical data buses 1 through 4 and one 
DK bus, in addition to the panel switches and 
the keyboards. In general, it can display flight 
instrument and subsystem data on more than 
one crew station (left, right, aft). On the MEDS 
side, each IDP controls a 1553B data bus that 
allows the IDP to interface with the MDUs and 
a pair of ADCs. 


IDPs require 28 V dc that is supplied by a main 
bus (IDP1 - main А/ЕРСІ, IDP2 - main 
B/FPC2, and IDP3 and 4 - main C/FPC3). The 
IDP power switches are located on panels C2 
and R11. These switches also power their 
respective CRT MDUs. Cooling is provided 
through forced-air ducting. 


The IDPs are in the forward cockpit beneath 
panels to the left of the commander and to the 
right of the pilot. An IFM capability is available 
to swap a forward IDP with the aft IDP. 


Integrated display processor 


Multifunction display unit 


Analog-to-digital converter 
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MEDS Hardware Units 
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Multifunction Display Unit (МО) 


The MDU is a full color, flat panel, 6.7-inch- 
square, active matrix liquid crystal display. Its 
primary function is to drive the variety of 
MEDS color displays that are readable in the 
sunlight. 


Similar to the IDP, the MDU has built-in tests to 
provide various test coverage for the processor, 
functions, and hardware. 


Six edgekeys are located below the display on 
the bezel of the MDU. A brightness control 
knob and an ON/OFF switch are also on the 
bezel on either side of the edgekeys. The 
edgekeys are used to navigate the MEDS menu 
system and to perform MEDS-specific activities, 
not to interact with the rest of the DPS system 
(1.е., clearing DPS fault messages, item entries). 


There are 11 MDUs: CDR 1 and 2 on panel F6; 
CRT 1, 2, and 3; MFD 1 and 2 on panel F7; PLT 1 
and 2 on panel F8; CRT 4 on panel R12; and 
AFD 1 in the aft station. 


In general, each MDU has two ports (primary 
and secondary) that are connected to two IDPs 
via a 1553B data bus. Only one IDP commands 
an MDU at a given time, but both IDPs monitor 
the status of the MDU. The exception is the 
CRT MDUSs, which use only their primary port. 
Their secondary port is not connected to any 
data bus. Thus, they are connected only to a 
single IDP and indirectly to only one DK data 
bus. Operationally, the CRT MDUSs аге 
dedicated to the DPS display. This config- 
uration maintains a one-to-one relationship 
between a DK bus, an IDP, and its CRT MDU. 
While in the autonomous mode, the MDU 
continues to run and monitors its two ports for 
an operating IDP. 


The MDUs are controlled by the power knob on 
the display bezel and a circuit breaker on panel 
R14. However, the CRT MDUs do not have a 
circuit breaker; they are powered Бу their 
respective IDP power switches. Main A powers 
МЕР 2 and PLT 1. Main В powers CDR 2 and 
МЕР 1. Main С powers CDR 1, PLT 2, and AFD 
1. The brightness control knob, located to the 
right of the edgekeys, controls the illumination 
of the menus and display. 


MDUs are cooled via forced-air cooling ducts. 
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The MDUs on the forward portion of the flight 
deck have а left and right group that 
correspond to the flight instrument display 
switches found on panel F6 (CDR side) and F8 
(PLT side). The left side (CDR crew station) 
consists of CDR 1, CDR 2, MFD 1, CRT 1, and 
CRT 3. The right side (PLT crew station) 
consists of CRT 2, PLT 1, PLT 2, and MFD 2. 
The aft crew station consists of AFD 1 and CRT 
4. CRT 4 is slightly tilted to improve 
readability. 


An MDU IFM capability is available. 


Analog-to-Digital Converter (ADC) 


The ADCs convert analog MPS, HYD, APU, 
OMS, and SPI subsystem data into 12-bit digital 
data to be used by the IDP to generate the 
displays on the MDUs. MEDS includes four 
ADC units (1A, 1B, 2A, 2B). ADCs 1A and 1B 
convert the analog signals from the MPS, OMS, 
and SPI meters. ADCs 2A and 2B convert the 
signals from the APU and HYD meters. Each 
ADC maintains communication with two IDPs 
simultaneously (the “As” with IDP 1 and 2 and 
the “Bs” with IDP 3 and 4). The ADC software 
performs a continuous self-test. 


ADC ТА and 2A are powered by main A via а 
single circuit breaker on panel R15, while 1B 
and 2B are powered by main B via a single 
circuit breaker on panel R15. 


Keyboards 


Three identical keyboards are located on the 
flight deck: one each on the left and right sides 
of the flight deck console (panel C2) and one on 
the flight deck at the side aft flight station 
(panel R11L). Each keyboard consists of 32 
momentary double-contact pushbutton keys. 
Each key uses its double contacts to permit 
communication on separate signal paths to two 
IDPs. Only one set of contacts on the aft station 
keys is actually used, because this keyboard is 
wired to communicate with only the aft IDP. 


There are 10 numeral keys, 6 letter keys (used 
for hexadecimal input), 2 algebraic keys, a 
decimal key, and 13 special function keys. 
Using these keys, the crew can ask the GPC 
more than 1000 questions about the mission and 
condition of the vehicle. 
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MEDS Data Bus Network 


IFMs are available to swap out keyboards and 
replace individual keys as failures occur. 


Each of the four IDPs responds to computer 
commands, transmits data, executes its own 
software to process keyboard inputs, and sends 
signals to drive displays on the MDUs. The 
IDPs store display data, generate the displays, 
update and refresh on-screen data, check 
keyboard entry errors, and echo keyboard 
entries to the DPS display shown on the MDU. 


MEDS Data Bus Network 


Each IDP has its own dedicated 1553B data bus 
that connects it to MDUs and two ADCs. 


Master Timing Unit 


The GPC complex requires a stable, accurate 
time source because its software uses 
Greenwich mean time (GMT) to schedule 
processing. Each GPC uses the master timing 


unit (MTU) to update its internal clock. The 
MTU provides precise frequency outputs for 
various timing and synchronization purposes to 
the GPC complex and many other orbiter 
subsystems. Its three time accumulators 
provide GMT and mission elapsed time (MET), 
which can be updated by external control. The 
accumulator's timing is in days, hours, minutes, 
seconds, and milliseconds up to 1 year. 


The MTU is a stable, crystal-controlled fre- 
quency source that uses two oscillators for 
redundancy. The signals from one of the two 
oscillators are passed through signal shapers 
and frequency drivers to the three GMT/MET 
accumulators. 


The MTU outputs serial digital time data 
(GMT/MET) on demand to the GPCs through 
the accumulators. The GPCs use this informa- 
tion for reference time and indirectly for time- 
tagging СМС and systems management 
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processing. The MTU also provides continuous 
digital timing outputs to drive the four digital 
timers in the crew compartment: two mission 
timers and two event timers. In addition, the 
MTU provides signals to the PCMMUS, 
COMSECs, payload signal processor, and FM 
signal processor, as well as various payloads. 


The GPCs start by using MTU accumulator 1 as 
their time source. Once each second, each GPC 
checks the accumulator time against its own 
internal time. If the time is within tolerance 
(less than one millisecond), the GPC updates its 
internal clock to the time of the accumulator, 
which is more accurate, and continues. However, 
if the time is out of tolerance, the GPC will try the 


other accumulators and then the lowest 
numbered GPC until it finds а successful 
comparison. 


The PASS GPCs do not use the MET that they 
receive from the MTU, because they compute 
MET on the basis of current GMT and lift-off 
time. 


The TIME display (SPEC 2) provides the 
capability to observe the current MTU and GPC 
clock status, synchronize or update the MTU 
and GPC clocks, and set CRT timers and alert 
tone duration and timers. 
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The MTU is redundantly powered by the ESS 
1BC MTU A and ESS 2CA MTU B circuit 
breakers on panel O13. The MASTER TIMING 
UNIT switch on panel O6 controls the MTU. 
When the switch is in AUTO, and a time signal 
from one oscillator is out of tolerance, the MTU 
automatically switches to the other oscillator. 
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For nominal operations, the MTU is using 
oscillator 2 with the switch in AUTO. The OSC 
1 or OSC 2 position of the switch manually 
selects oscillator 1 or 2, respectively. 


The MTU is located in crew compartment 
middeck avionics bay 3B and is cooled by a 
water coolant loop cold plate. The hardware 
displays associated with the master timing unit 
are the mission and event timers. MISSION 
TIME displays are located on panels O3 and A4. 
They can display either GMT or MET in 
response to the GMT or MET positions of the 
switch below the displays. The forward EVENT 
TIME display is on panel F7, and it is controlled 
by the EVENT TIME switches on panel C2. The 
aft EVENT TIME display is on panel A4, and 
its EVENT TIME control switches are on panel 
A6U. 
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MISSION TIME Display and Switch 
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MISSION TIME and EVENT TIME Displays 
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Software 


Primary Avionics Software System (PASS) 


The PASS (also referred to as primary flight 
software) is the principal software used to 
operate the vehicle during a mission. Ї 
contains all the programming needed to fly the 
vehicle through all phases of the mission and 
manage all vehicle and payload systems. 


Because the ascent and entry phases of flight are 
so critical, four of the five GPCs are loaded with 
the same PASS software and perform all GNC 
functions simultaneously and redundantly. As 
a safety measure, the fifth GPC contains a 
different set of software, programmed by a 
company different from the PASS developer, 
designed to take control of the vehicle if a 
generic error in the PASS software or other 
multiple errors should cause a loss of vehicle 
control. This software is called the backup 
flight system (BFS). In the less dynamic phases 
of on-orbit operations, the BFS is not required. 
The information provided below describes how 
the PASS software relates to the DPS and the 
crew. Much of the material is common between 
PASS and BFS; therefore, only BFS differences 
are discussed immediately after the PASS 
discussion. 


DPS software is divided into two major groups, 
system software and applications software. The 
two groups are combined to form a memory 
configuration for a specific mission phase. The 
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programs are written in HAL/S (high-order 
assembly language/shuttle) specifically devel- 
oped for real-time space flight applications. 


System software is the GPC operating system 
software that controls the interfaces among the 
computers and the rest of the DPS. It is loaded 
into the computer when it is first initialized. It 
always resides in the GPC main memory and is 
common to all memory configurations. The 
system software controls GPC input and output, 
loads new memory configurations, keeps time, 
monitors discretes into the GPCs, and performs 
many other DPS operational functions. 


The system software consists of three sets of 
programs. The flight computer operating system 
(FCOS) (the executive) controls the processors, 
monitors key system parameters, allocates 
computer resources, provides for orderly 
program interrupts for higher priority activities, 
and updates computer memory. The user 
interface programs provide instructions Юг 
processing flight crew commands or requests. 
The system control program initializes each GPC 
and arranges for multi-GPC operation during 
flight-critical phases. 


One of the system software functions is to 
manage the GPC input and output operations, 
which includes assigning computers as com- 
manders and listeners on the data buses and 
exercising the logic involved in sending 
commands to these data buses at specified rates 
and upon request from the applications software. 
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The applications software performs the func- 
tions required to fly and operate the vehicle. To 
conserve main memory, the applications soft- 
ware is divided into three major functions: 


е Guidance, navigation, and control 
(GNC): specific software required for 
launch, ascent to orbit, maneuvering in 
orbit, entry, and landing. This is the 
only major function where redundant 
set synchronization can occur. 


e Systems management (SM): tasks that 
monitor various orbiter systems, such as 
life support, thermal control, commu- 
nications, and payload operations. SM 
is a simplex major function; only one 
GPC at a time can actively process an 
SM memory configuration. 


е Payload (PL) this major function 
currently contains mass memory utility 
software. The PL major function is 
usually unsupported in flight, which 
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means that none of the GPCs are loaded 
with PL software. It is only used in 
vehicle preparation at KSC, and is also a 
simplex major function. Note that soft- 
ware to support payload operations is 
included as part of the SM GPC memory 
configuration. 


Major functions are divided into mission phase 
oriented blocks called operational sequences 
(OPS). Each OPS of a major function is 
associated with a particular memory configura- 
tion that must be loaded separately into a GPC 
from the MMUs. Therefore, all the software 
residing in a GPC at any given time consists of 
system software and an OPS major function; 
1е., one memory configuration. Except for 
memory configuration 1, each memory 
configuration contains one OPS. Memory 
configuration 1 is loaded for GNC at launch and 
contains both OPS 1 (ascent) and OPS 6 (RTLS), 
since there would be no time to load in new 
software for a return to launch site (RTLS) 
abort. 


Orbiter 
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software computer software 
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Major 
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post CHKOUT doors doors memory 
landing utility 
2 
901 101 201 801 301 201 401 901 ^ 
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uration count coast CHKOUT deorbit орега- орега- тетогу 
monitor coast tions tions 
102 202 302 202 402 
First MNVR De- PL bay PL bay 
stage EXEC deorbit door door 
EXEC operations! |орегайоп5 
03 303 
Second OPS 6 Pre-entry 
stage RTLS monitor 
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04 304 оде 
OMS 1 601 Entry 
insrtn RTLS 
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ОМ5 2 602 ТАЕМ/ 
insrtn . landing 
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During the transition from one OPS to another, 
called an OPS transition, the flight crew 
requests a new set of applications software to be 
loaded in from the MMU. Every OPS transition 
is initiated by the flight crew. When an OPS 
transition is requested, the redundant OPS 
overlay contains all major modes of that sequence. 


Major modes are further subdivisions of an 
OPS, which relate to specific portions of a 
mission phase. Ав part of one memory 
configuration, all major modes of a particular 
OPS are resident in GPC main memory at the 
same time. The transition from one major mode 
to another can be automatic (e.g., in GNC OPS 1 
from precount MM 101 to first stage MM 102 at 
lift-off) or manual (e.g., in SM OPS 2 from on-orbit 
MM 201 to payload bay door MM 202 and back). 


Each major mode has an associated DPS 
display, called a major mode display or base 
page, that provides the flight crew with 
information about the current portion of the 
mission phase and allows crew interaction. 
There are three levels of DPS displays. Certain 
portions of each OPS display can ђе 
manipulated by flight crew keyboard input (or 
ground link) to view and modify system 
parameters and enter data. The specialist 
function (SPEC) of the OPS software is a block 
of displays associated with one or more 
operational sequences and enabled by the flight 


2. SYSTEMS 
2.6 Data Processing System 


crew to monitor and modify system parameters 
through keyboard entries. The display function 
(DISP) of the OPS software is a group of dis- 
plays associated with one or more OPS. These 
displays are for parameter monitoring only (no 
modification capability) and are called from the 
keyboard. Display hierarchy and usage are 
described in detail later in this section. 


Backup Flight System 


Even though the four PASS GPCs control all 
GNC functions during the critical phases of the 
mission, there is always a possibility that a 
generic software failure could cause loss of 
vehicle control. Therefore, the fifth GPC is 
loaded with the BFS software. To take over 
control of the vehicle, the BFS monitors the 
PASS СРС$ to keep track of the current state of 
the vehicle. If required, the BFS can take over 
control of the vehicle upon the press of a button. 
The BFS also performs the SM functions during 
ascent and entry because the PASS СРС» are all 
operating in СМС. ВЕЅ software is always 
loaded into GPC 5 before flight, but any of the five 
GPCs could be made the BFS GPC if necessary. 


Because the BFS is intended to be used only in a 
contingency, its programming is much simpler 
than that of the PASS. Only the software neces- 
sary to complete ascent or entry safely, maintain 
vehicle control in orbit, and perform SM 
functions during ascent and entry is included. 


2.6-22 


Thus, ай the software used by the BFS can fit 
into one GPC and never needs to access mass 
memory. For added protection, the BFS soft- 
ware is loaded into the MMUs in case of a BFS 
GPC failure and the need to IPL a new BFS СРС. 


The BFS, like PASS, consists of system software 
and applications software. System software in 
the BFS performs basically the same functions 
as it does in PASS. These functions include 
time management, PASS/BFS interface, MEDS 
interface, input and output, uplink and down- 
link, and engage and disengage control. The 
system software is always operating when the 
BFS GPC is not in HALT. 


Applications software in the BFS has two 
different major functions, GNC and systems 
management, but all its applications software 
resides in main memory at one time, and the 
BFS can process software in both major 
functions simultaneously. The GNC functions 
of the BFS, designed as a backup capability, 
support the ascent phase beginning at MM 101 
and the deorbit/entry phase beginning at MM 
301. In addition, the various ascent abort 
modes are supported by the BFS. The BFS 
provides only limited support for on-orbit 
operations via MM 106 or MM 301. Because the 
BFS is designed to monitor everything the PASS 
does during ascent and entry, it has the same 
major modes as the PASS in OPS 1, 3, and 6. 


The BFS SM contains software to support the 
ascent and entry phases of the mission. 
Whenever the BFS GPC is in the RUN or STBY 
mode, it runs continuously; however, the BFS 
does not control the payload buses in STBY. 
The SM major function in the BFS is not 
associated with any operational sequence and is 
always available whenever the BFS is active. 


Even though the five GPCs and their switches 
are identical, the GENERAL PURPOSE 
COMPUTER MODE switch on panel O6 works 
differently for a GPC loaded with BFS. Since 
HALT is a hardware-controlled state, no soft- 
ware is executed. Тһе STBY mode in the BFS 
GPC is totally different from its corollary in the 
PASS GPCs. When the BFS GPC is in STBY, all 
normal software is executed as if the BFS were 
in RUN; the only difference is that BFS 
command of the payload data buses is inhibited 
in STBY. The BFS is normally put in RUN for 
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ascent and entry, and in STBY whenever a PASS 
systems management GPC is operating. If the 
BFS is engaged while the MODE switch is in 
STBY or RUN, the BFS takes control of the 
flight-critical and payload data buses. The 
MODE talkback indicator on panel O6 indicates 
RUN if the BFS GPC is in RUN or STBY and 
displays barberpole if the BFS is in HALT or has 
failed. 
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GENERAL PURPOSE COMPUTER MODE 
Switches and Talkbacks on Panel Об 


Pre-engage, the BFS is synchronized with the 
PASS set using flight-critical I/O so that it can 
track the PASS and keep up with its flow of 
commands and data. Synchronization and 
tracking take place during OPS 1, 3, and 6. 
During this time, the BFS listens over the flight- 
critical data buses to the requests for data by 
PASS and to the data coming back. The BFS 
depends on the PASS GPCs for acquisition of all 
its GNC data and must be synchronized with 
the PASS GPCs so that it will know when to 
receive GNC data over the FC buses. When the 
BFS is in sync and listening to at least two 
strings, it is said to be tracking PASS. As long as 
the BFS is in this mode, it maintains the current 
state vector and all other information necessary 
to fly the vehicle in case the flight crew needs to 
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engage it. When the BFS GPC is tracking the 
PASS GPCs, it cannot command over the FC 
buses but may listen to FC inputs through the 
listen mode. The BFS uses the MTU (like PASS) 
and keeps track of GMT over the flight-critical 
buses for synchronization. The BFS also 
monitors some inputs to PASS IDPs and 
updates its own GNC parameters accordingly. 


The BFS GPC controls its own instrumentation/ 
PCMMU data bus. The BFS GPC requirements 
strictly forbid use of the ICC data bus to 
monitor or to transmit status or data to the 
other GPCs. The mass memory data buses are 
not used except during initial program load, 
which uses the same IPL SOURCE switch on 
panel Об as used for PASS IPL. 


The BFC lights on panels F2 and F4 remain 
unlighted as long as PASS is in control, and the 
BFS is tracking. The lights flash if the BFS loses 
track of the PASS and goes standalone. The 
flight crew must then decide whether to engage 
the BFS or try to initiate BFS tracking again by 
an I/O RESET on the keyboard. When BFS is 
engaged and in control of the flight-critical 
buses, the BFC lights are illuminated and stay 
on until the BFS is disengaged. 


Since the BFS does not operate in a redundant 
set, its fail votes from and against other GPCs 
are not enabled; thus, the GPC STATUS light 
matrix on panel O1 for the BFS GPC does not 
function as it does in PASS. The BFS can 
illuminate its own light on the GPC STATUS 
matrix if the watchdog timer in the BFS GPC 
times out when the BFS GPC does not complete 
its cyclic processing. 


To engage the BFS, which is considered a last 
resort to save the vehicle, the crew presses a 
BFS ENGAGE momentary pushbutton located 
on the commander's and pilot's rotational hand 
controllers (RHCs). As long as the RHC is 
powered, and the appropriate OUTPUT switch 
on panel O6 is in BACKUP, depressing the 
ENGAGE pushbutton on either RHC engages 
the BFS and causes PASS to relinquish control. 
There are three contacts in each ENGAGE 
pushbutton, and all three contacts must be 
made to engage the BFS. The signals from the 
RHC are sent to the backup flight controller, 
which handles the engagement logic. 
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When the BFS is engaged, the BFC lights on 
panels F2 and F4 are steadily illuminated, the 
BFS's OUTPUT talkback indicator on panel Об 
turns gray, all PASS GPC OUTPUT and MODE 
talkback indicators on panel O6 display barber- 
pole, the BFS controls the IDPs selected by the 
BFC CRT SELECT switch on panel C3, big Xs 
and poll fails appear on the remaining PASS- 
controlled IDPs, and all four GPC STATUS 
matrix diagonal indicators for PASS GPCs are 
illuminated on panel O1. 
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BFC DISENGAGE Switch on Panel F6 


When the BFS is not engaged, and the BFC CRT 
DISPLAY switch on panel C3 is positioned to 
ON, the BFS commands the first IDP indicated 
by the BFC CRT SELECT switch. The BFC CRT 
SELECT switch positions on panel C3 are 1 * 2, 
2 * 3, and 3 * 1. When the BFS is engaged, it 
assumes control of the second IDP as well. 


If the BFS is engaged during ascent, the PASS 
GPCs can be recovered on orbit to continue a 
normal mission. This procedure takes about 2 
hours, since the PASS inertial measurement unit 
reference must be reestablished. Тһе ВЕС is 
disengaged after all PASS GPCs have been 
hardware-dumped and reloaded with PASS 
software. Positioning the BFC DISENGAGE 
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switch on panel F6 to the RIGHT position disen- 
gages the BFS. The switch sends a signal to the 
BFCs that resets the engage discretes to the GPCs. 
The BFS then releases control of the flight-critical 
buses as well as the payload buses if it is in STBY, 
and the PASS GPCs assume command. 


After disengagement, the PASS and BFS GPCs 
return to their normal pre-engaged states. Indi- 
cations of the PASS engagement and BFS 
disengagement are as follows: BFC lights on 
panels F2 and F4 are out, BFS's OUTPUT 
talkback on panel O6 displays barberpole, all 
PASS OUTPUT talkback indicators on panel Об 
are gray, and BFS releases control of one of the 
IDPs. 


If the BFS is engaged, there is no manual thrust 
vector control or manual throttling capability 
during first- and second-stage ascent. If the BFS 
is engaged during entry, the speed brake can be 
positioned using the speed  brake/throttle 
controller, and the body flap can be positioned 
manually. Control stick steering (CSS) by either 
the commander or pilot is required during entry. 


Pre-engage, the BFS supplies attitude errors on 
the Trajectory display, whereas PASS supplies 
attitude errors to the attitude director indicators; 
however, when the BFS is engaged, the errors on 
the Trajectory display are blanked, and attitude 
errors are supplied to the attitude director 
indicators. 


MEDS 


IDP Software 


The IDP software manages the edgekey menu 
system, generates the graphical displays, and 
emulates the display electronics unit (DEU) for 
the DPS displays. It also processes data from 
the flight-critical, display/keyboard, and 1553 
data buses, in addition to the switches and the 
keyboards. 


The IDP only receives data on the flight-critical 
buses. It is able to process data simultaneously 
on two different flight-critical buses for flight 
instrument displays on different MDUs. The IDP 
communicates on the display / keyboard buses оп 
a two-way command/response basis. The IDP 
receives data over the DK bus for updating the 
DPS displays. The IDP sends crew inputs and 
MEDS health status information to the GPC 
when polled by it. 
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The IDP also processes the following panel 
switches: IDP load switch, IDP/CRT select 
switches (left and right), and the major function 
switches. The IDP validates keystrokes made 
on the keyboard for syntax. If at least one of the 
MDwUs controlled by the IDP is displaying the 
DPS display, the keystrokes will be validated, 
echoed, and included in the poll response of the 
IDP to the GPC. 


MDU Software 


The MDU function (MDUF) software is 
responsible for drawing the displays on the 
MDU and providing built-in test capability 
(BITE). 


MEDS Generic Screen Format 


Each MDU screen follows a generic screen 
format. The top portion of the screen is denoted 
as the MEDS display format. The lower portion 
contains the MEDS internal configuration 
information. A horizontal cyan line separates 
the two portions. The upper portion is blank or 
displays the selected MEDS display. At the 
bottom, the legends for the edgekeys are 
displayed in the six boxes that are aligned with 
their respective edgekeys. The color of the 
boxes and the labels normally are cyan, unless 
they correspond to the current MEDS display, 
in which case they are white. A blank edgekey 
legend means no option is available for that 
edgekey. If the edgekey is pressed, the IDP 
ignores it. The menu title is displayed above 
the edgekey boxes and legend. The MEDS fault 
message line is the line above the menu title. 
Any MEDS-generated messages are displayed 
in white on this line. Any GPC generated 
messages are displayed on the DPS display in 
orange (above the cyan horizontal line). 


MEDS configuration information is displayed to 
the left and the right of the menu bars. The 
information to the left indicates which MDU 
port is selected and which IDP is connected to 
each MDU port. “P” indicates primary port and 
“5” indicates the secondary port. The numbers 
next to the P and S indicate the IDP that is 
connected to that port of the MDU. An asterisk 
indicates which port (and thus which IDP) is 
selected to command the MDU. The infor- 
mation displayed to the right of the menu bars 
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indicates the port select configuration and 
flight-critical data bus selected for that MDU. 
The flight-critical data bus selected is the 
number displayed next to "FC." The port 
reconfiguration mode is displayed below the 
flight critical data bus information. "AUT" is 
displayed when automatic port reconfiguration 
capability has been selected and "MAN" is 
displayed when manual  reconfiguration 
capability has been selected. Each MDU retains 
its current configuration through a power cycle 
(except for the menu, which reverts to the menu 
associated with the display on the MDU). 


MEDS DISPLAY 


MEDS FAULT MESSAGE LINE 
MENU TITLE LINE 


1071.CV5 


MEDS Generic Screen Format 


MEDS Displays 


The user may view all flight instrument and 
subsystem status information via the various 
MEDS displays. 


Flight Instrument Displays 


The flight instrument displays give the crew 
insight into the current attitude, position, and 
velocity of the vehicle. During ascent and entry, 
the crew can view the Ascent/Entry Primary 
Flight Display (A/E PFD). This display consists 
of several indicators and gauges giving insight 
into the attitude, altitude, position, velocity, and 
angle of attack. For orbit, only attitude 
information is used; therefore, another display 
is available that consists solely of that data, 
called the Orbit PFD. The PFDs work as 
described in Section 2.7, Dedicated Display 
Systems. 
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Typical Ascent MEDS Layout 


DPS Display 


The MEDS DPS display shows the DPS displays 
to the crew. The IDP emulates the old "CRT" 
system using data it obtains over the DK bus. 
The DPS display allows the crew to interact 
with the GPCs by entering commands via the 
keyboards to monitor a variety of systems data. 


The GPC fill portion of the DPS display is 
covered in detail later in this section. 


In the MEDS-driven portion, a green outlined 
box with a number inside of it has been added 
just below the scratch pad line and centered 
horizontally. The number represents the IDP 
that is commanding the MDU. 


Subsystem Status Displays 


The MEDS Subsystem Status displays are used 
to monitor the performance of several systems 
in graphical format. 


The displays available include an Orbital 
Maneuvering System and Main Propulsion 
System (OMS/MPS) display, a Hydraulic and 
Auxiliary Power Unit (HYD/ APU) display, and 
a Surface Position Indicator (ЭРТ) display. 


For discussion on each of these displays, see the 
appropriate section of the SCOM. 


MEDS Maintenance Display 


The MEDS maintenance display provides an 
overview of the current configuration of the 
MEDS system as viewed by the commanding 
IDP of the MDU. The MEDS maintenance 
display shows all the MEDS LRUs as a box. The 
forward MDUs are arranged on the display the 
same way as they are arranged in the forward 
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flight deck. Displayed below them are the four 
IDPs. The ADCs and the aft MDUs are dis- 
played graphically below the IDPs. Each of the 
LRUs commanded by the current IDP has a blue 
background for its box. Each LRU box provides 
information about its configuration, status, 
and/or comprehensive self-test (CST) results. 
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(2) identities FC bus number 
or CST results (HEX) 
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MEDS Maintenance Display 


The MDU boxes provide information on the 
port configuration, flight-critical bus selection, 
and status of the MDU. The first row in the box 
indicates the name of the LRU. The second row 
denotes the IDPs that are connected to the 
primary and secondary ports. The third row 
displays the flight-critical bus selected, if that 
MDU is displaying a flight instrument display; 
otherwise, it is blank. The fourth row indicates 
if the MDU is in the AUTO or MANUAL 
reconfiguration mode. This reconfiguration 
mode is also displayed on the MDUs with 
which the IDP is communicating but not 
commanding (no blue background). The fifth 
row indicates the operational BITE summary in 
hex. If one or more bits in the BITE summary 
are off nominal, the entire BITE summary 
shows red. The sixth row indicates the dump 
status (text) or CST results (hex). If one or more 
bits in a CST result are off nominal, the entire 
CST result is displayed in red. If a CST has not 
been performed, the CST results display NO- 
CST in white. The last row of the box contains 
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the version number of the software loaded in 
the MDU; e.g., V 0400. 


Тһе IDP boxes provide information on the 
flight-critical bus selection and status of the 
IDP. The first row in the box indicates the name 
of the LRU. The second row denotes the 
operational BIT summary in hex. If one or more 
bits in the BIT summary are off nominal, the 
entire BIT summary is red. Тһе third row 
indicates the dump status (text) or CST results 
(hex). If one or more bits in a CST result are off 
nominal, the entire CST result is displayed in 
red. If a CST has not been performed, the CST 
results display NO-CST in white. The fourth 
row indicates which flight-critical data buses 
currently are being supported. The buses are 
displayed in reverse video. The last row 
contains the version number of the software 
loaded in the IDP; e.g., V 0300. 


Ihe ADC boxes provide information on the 
status of the ADC. The first row in the box 
indicates the name of the LRU. The second row 
denotes the operational BITE summary in hex. 
If one or more bits in the BITE summary are off 
nominal, the entire BITE summary is red. The 
last row indicates the dump status (text) or CST 
results (hex). If one or more bits in a CST result 
are off nominal, the entire CST result is 
displayed in red. 


MEDS Fault Summary Display 


The MEDS fault summary display is the MEDS 
equivalent of the GPC fault summary (SPEC 
99). The display lists the past 15 MEDS fault 
messages and the time of annunciation by the 
current ТЮР. 


Edgekey Menu System 


The user accesses the edgekey menu system to 
control the MEDS system. The MEDS edgekey 
operations are organized by function and are 
displayed in the proper hierarchy. In general, 
edgekeys call up an additional menu, select a 
MEDS configuration, select a particular MEDS 
display, and initialize internal tests of the 
MDUs, ADCs, and IDPs. Except for the top 
menu (the main menu), the first edgekey (on the 
left) is the up arrow, which allows the user to go 
up to the next level. The main menu allows the 
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user to select the flight instrument menu, 
subsystem status menu, the DPS display, and 


the MEDS maintenance display and its menu. 
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MEDS Fault Summary Display 


Throughout the various menus, the user can 
select MEDS MSG ACK or MEDS MSG RESET. 
These edgekey operations are single-stroke 
keys. The MEDS MSG ACK works the same as 
the keyboard ACK key. The first time that it is 
pressed, the MEDS fault messages goes static. 
Subsequent pressings of the edgekey scroll 
through the remaining MEDS fault messages. 
The MEDS MSG RESET clears the MEDS fault 
message line just like the MSG RESET key 
works for the DPS displays. 


The flight instrument menu allows the user to 
select either ascent/entry or orbit displays, a 
flight critical data bus, or clear the MEDS fault 
message line. The A/E PFD displays the COMP 
ADI/HSI display. The orbit selection displays 
the ADI only. The data bus select menu 
maintains the current flight instrument MEDS 
display, but allows the user to choose flight- 
critical 1 through 4. 


The subsystem status menu allows the user to 
access the MEDS displays to view the OMS, MPS, 
HYD, APU, and SPI information that was 
available previously on the analog meters. The 
user may swap between these various subsystem 
displays with just a single press of the appropriate 
edgekey. This menu allows the user to port select 
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on the MDU in case the current commanding ПОР 
has a problem with an ADC. This submenu also 
allows the user to select MEDS MSG ACK. 


After selecting the DPS menu, the DPS display 
shows automatically. The edgekey options are 
the MEDS MSG ACK and MSG RESET. 


After selecting the MEDS maintenance menu, 
the MEDS maintenance display is displayed 
automatically. From this menu, the user can 
select any of the following submenus: fault 
summary, configuration status, CST, or memory 
management. 


After selecting the fault summary option, the 
MEDS fault summary display is shown. With 
this submenu, the user can clear the MEDS fault 
messages, similar to a SPEC 99 PRO but for 
MEDS. The options to MEDS MSG RESET and 
ACK are also included on this menu. 


The configuration status submenu allows the 
viewer to port select to the alternate IDP, 
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change its reconfiguration mode to either 
AUTO or MAN, or change the viewing mode. 
The viewing mode can be changed only for the 
Hosiden MDUs (all flight MDUs are Hosiden). 
The negative viewing mode enhances the read- 
ability of the aft MDUs. When negative 
viewing is selected, “NEG VIEW" is displayed 
above the flight-critical bus selection and 
reconfiguration mode on the MEDS status area 
of the MDU. 


The CST submenu lets the user activate the CST 
for the current MDU, the commanding IDP, and 
the associated ADC1X and ADC2X for the 
commanding IDP. The CST is a test of the hard- 
ware and the functional use of the MEDS LRU. 
It has both interactive and noninteractive parts 
for the IDP and MDU. The ADC CST is not 
interactive. During the IDP CST, other MDUs 
being commanded by this IDP will blank and 
display the message IDP CST INITIATED. The 
results of the CST are displayed on the MEDS 
maintenance display. 
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The memory management menu has several 
options. Тһе edgekey menu tree does not 
display the submenus for each of the possible 
selections. In general, the memory management 
menu allows the user to dump the EEPROM 
and/or RAM for the ADC, MDU, and IDP to 
the MSU, load IDP or MDU programs from the 
MSU, load an IDP program load from 
EEPROM, and patch files on the MSU. 
Currently, no crew procedure references these 
memory management functions. 


MEDS Fault Messages 


Each IDP has various messages that it can 
annunciate. Each MEDS error can be broken 
down into seven categories (A through G, with 
A being the most severe). The IDP generates a 
MEDS fault message for the categories that 
warrant crew notification. The other categories 
cause the IDP to notify the ground, archive the 
method other than a MEDS fault message. 


MEDS fault messages for an IDP are displayed 
on all commanded MDUs that are showing the 
DPS display. If none of an IDP's commanded 
MDUS has a DPS display, the ТЮР will select the 
MDU with the highest ranking that is available 
for the MEDS fault messages. 


Operations 


The crew interfaces with the five СРС$ via the 
four IDPs and their MDUs. This section first 
discusses crew operations using PASS, and then 
discusses crew operations using the BFS. 


IDP Load Switch 


The IDP load switch, located on panel O6, is 
used to load the critical format information for 
the DPS displays. The critical formats form a 
skeleton that the IDP uses and fills with GPC- 
provided data. When the IDP load switch is 
toggled and a GPC is running an ops mode that 
supports the load (SM OPS 2 or 4, PL OPS 9, or 
post-IPL OPS 0), the IDP receives the GPC 
information and stores only the critical format 
information in the EEPROM (other information 
is sent that was used by the old CRT system). 


Nominally, the only time the IDP needs to be 
loaded with critical formats is after an OI flight 
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software change in the GPCs. If a GPC does not 
recognize the IDP load request (i.e., it is a GNC 
computer), an IDP power cycle recovers full 
capability of the IDP with no loss of its critical 
formats. 


IDP Switches 


Switches on panel C2 designate which keyboard 
controls each forward IDP. When the LEFT 
IDP/CRT SEL switch is positioned to 1, the left 
keyboard controls IDP 1; if the switch is 
positioned to 3, the left keyboard controls IDP 3. 
When the RIGHT CRT SEL switch on panel C2 
is set to 2, the right keyboard controls IDP 2; if 
set to 3, it controls IDP 3. Thus, flight crew 
inputs are made on the keyboards, and data are 
output from the GPCs on the DPS displays. 
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If the LEFT IDP/CRT SEL and RIGHT 
IDP/CRT SEL switches аге both 
positioned to 3, keystrokes from both 
keyboards are interleaved. 


The aft station panel R11L keyboard is connected 
directly to the aft panel R11L ТЮР; there is no 
select switch. 


These switch positions also drive the MEDS 
colored keyboard bars. If the LEFT IDP/CRP 
SEL switch is selected to IDP 3 (in other words, 
the commander’s keyboard is talking to IDP 3), 
a red horizontal bar will be displayed to the left 
of the box for IDP 3’s DPS display. If the switch 
is moved to IDP 1, the red bar will disappear 
from ШР 3’s DPS display and move to the left 
of the box on ШР 1’s DPS display. The pilot's 
keyboard bar is yellow and is displayed to the 
right of the box. Red and yellow were chosen, 
because the crew already associates the CDR 
with red and the PLT with yellow for FDF, food, 
etc. Because the DPS displays can be called up 
on any MDU, this information is helpful in 
knowing which IDP a keyboard is talking to 
and which IDP’s DPS display is being 
displayed. IDP 4’s DPS display does not have 
any keyboard bars displayed, because only the 
aft keyboard can talk to it. 


Each IDP has an associated МА] FUNC switch. 
The IDP/CRT 1, 3, 2, MAJ FUNC switches on 
panel C2 tell the GPCs which of the different 
functional software groups is being processed 
by the keyboard units and what information is 
presented on the IDP’s DPS display. The 
IDP/CRT 4 MAJ FUNC switch on panel R11L 
functions in the same manner. This three- 
position toggle switch allows the crew access to 
the GNC, SM, or PL software on a desired IDP. 
The GPC loaded with the desired major 
function applications software will then drive 
this IDP’s DPS display. Each major function 
accesses an independent set of display data and 
functional software. 
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Possible IDP/Keyboard Assignments in 
the Forward Flight Station 


MDU Configuration 


Overview 


Nominally, MDUs are configured to their 
primary ports and are in automatic port 
reconfiguration mode. CRT MDUs show the 
DPS (CRT) display. In general, the CDR and 
PLT MDUs display the flight instruments, while 
the MFD MDUs display the subsystem displays. 
This configuration is similar to the old non- 
MEDS display configuration. 
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Selecting Alternate MDU Ports 


Automatic port reconfiguration capability 
allows the MDU to swap automatically to the 
other port if the MDU loses communication 
with the currently selected IDP. Manual port 
reconfiguration capability does not do a port 
select automatically. The user has to manually 
reconfigure the MDU onto its alternate port. 
Operationally, MDUs will always be in auto 
reconfiguration mode. If an MDU is in manual 
mode and loses communication with the 
selected IDP, or if an MDU is in automatic 
reconfiguration mode and loses communication 
with the IDPs on both ports, the MDU is in 
autonomous mode. The MDU blanks the MEDS 
display and displays the following message: 
MDU IS AUTONOMOUS. The menu changes 
to allow the user to reconfigure to automatic 
port selection, manual primary port, or manual 
secondary port. 


The user can select alternate ports by navigating 
through the MEDS edgekey menus to either the 
subsystem menu or the MEDS maintenance 
menu. The port select option was included in 
the subsystem menu in case of failure of 
ап ADC. If an ADC that the current IDP com- 


mander is using fails, it cannot display all of the 
subsystem status information. For the MFD 
MDUSs, СОК 1, апа PLT 2, the IDPs on the 
alternate port were wired so that they will 


access the other set of ADCs. A рогі 
reconfiguration allows recovery of all 
subsystem status information. (Note that 


nominally, the МЕР MDUs display subsystem 
status displays.) 


Recovering from a Disabled Edgekey 


When an edgekey has been disabled, a red "X" 
appears on the edgekey legend box. An edge- 
key is disabled when it is pressed continuously 
for 3 seconds or longer or when MEDS detects 
that it failed closed. To recover from an acci- 
dental edgekey disable, it is necessary to power 
cycle the MDU via its power knob on the 
display unit. 


Selecting Negative Viewing 


The configuration status submenu allows the 
viewer to change the viewing mode. The 
viewing mode can be changed only for the 
Hosiden MDUs. The negative viewing mode 
enhances the readability of the aft MDUs. 
When negative viewing is selected, “NEG 
VIEW” is displayed above the flight-critical bus 
selection and reconfiguration mode on the 
MEDS status area of the MDU. 
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IDP/CRT 4 POWER and MAJ FUNC Switches 
on Panel R11L 


Display Hierarchy 


DPS display organization consists of three 
levels of crew software displays within any 
given major function. The display types 
parallel the different types of modules used in 
the GPC software. The established display 
hierarchy within applications software 15 
operational sequences (OPS), specialist 
functions (SPEC), and display (DISP) functions. 


The OPS is the highest level of crew software 
control within a major function. Each memory 
configuration contains one or more OPS. Each 
OPS allows the crew to accomplish an associ- 
ated mission phase task. Several operational 
sequences are defined, each covering some 
portion of the mission. For example, OPS 1 
contains ascent software, OPS 2 contains on-orbit 
software, and ОР5 3 contains entry software. 


Each operational sequence is further divided 
into major modes. Each major mode has an 
associated display that allows direct crew inter- 
face with the software. These are OPS pages, 
and are also referred to as major mode pages. 
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Specialist functions (SPECs) are second in the 
hierarchy. A SPEC allows crew execution of 
other activities in conjunction with a particular 
OPS. SPEC displays, like major mode displays, 
allow direct crew interface with the software. 
Each SPEC has an associated display that 
overlays the major mode display when called. 
When a SPEC is called, its display rolls in on 
top of the major mode display, which is still 
active underneath. The SPEC provides access to 
an associated portion of the software located in 
the GPC. Some SPECs are contained in systems 
software, whereas others are resident in the 
applications load. A SPEC can be associated 
with a major function or an OPS, but the 
systems software SPECs can be obtained in 
most OPS and major functions. (The list of 
SPECs and their availability is found in the DPS 
Dictionary.) 


Display functions (DISPs) are the lowest level of 
software. Each DISP has an associated display 
that presents the status of a predefined set of 
parameters. Unlike major mode displays or 
SPECs, a DISP cannot initiate a change in 
software processing because DISP displays do 
not permit direct crew interface with the 
software. They provide information only. 


When called, a DISP overlays the major mode 
display and the SPEC, if one is active. Both the 
SPEC and the major mode display are overlaid, 
and access to them can be easily regained. The 
method of terminating the processing of SPECs 
and DISPs is discussed later. 


The Keyboard 


Each keyboard is composed of a 4 x 8 matrix of 
32 pushbutton keys. This matrix consists of: 


e Sixteen alphanumeric keys: 0 through 9 
and A through F, for a hexadecimal 
numbering system. 


e Two sign keys (+ and -) serving the dual 
roles of sign indicators and delimiters. 
A delimiter is used to separate discrete 
keyboard entries from their associated 
data. 


e One decimal point key for use in 
entering data with decimal notation. 
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e Thirteen special function keys: some of 
these keys are single stroke commands, 
and some are keys that start or finish a 
multi-stroke command sequence. A key 
that starts a command sequence is a 
command initiator and requires a 
command terminator key to Бе 
depressed to tell the IDP the keyboard 
entry is complete. 


SINGLE KEYSTROKE COMMANDS 


FAULT|| sys || Msc || еа 
SUMM || SUMM || RESET 
ОРС/ 
СВТ A В ( 
MULTI-STROKE 
INITIATORS. || 1/0 ) Е Е 
ВЕОШВЕ ЕХЕС ВЕЗЕТ 
А5 ТЕВММАТОВ. 
ІТЕМ 1 2 3 
TERMINATOR 
FOR ABOVE +- | ЕХЕС 4 5 6 
INITIATORS. 
MULTI-STROKE OPS T 8 9 
INITIATORS. | 
REQUIRE PRO 
AS TERMINATOR. | SPEC || — 0 + 
RESUME СПЕАН || e РВО 


| 
ТЕКМІМАТОК 
ҒОК ОР5 АМО 5РЕС 
233 


| 
SINGLE KEYSTROKE 
COMMANDS 


Multifunction Electronic Display System 
Keyboard Unit on Panels C2 and R11L 


Each of these keys is discussed below. 


ACK acknowledges receipt of a fault message 
on the fault message line by causing the 
message to become static and by extinguishing 
the SM ALERT light and software-controlled 
tones. If multiple messages are indicated on the 
DPS display, each subsequent press of the АСК 
key will bring up Ше next oldest 
unacknowledged message and clear out the last 
acknowledged one. 


MSG RESET operates as a single keystroke 
command that clears both the currently 
annunciated fault message and the buffer 
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message indicator (if any) from the fault 
message line. The fault message line is the 
second to the last line on the DPS display. 
Depressing this key will also extinguish all 
software-driven caution and warning 
annunciators, software-controlled tones, and the 
SM ALERT light Ап ILLEGAL ENTRY 
message can only be cleared with the MSG 
RESET key. 


SYS SUMM is used to invoke the SYS SUMM 
display. The particular display called is 
determined by the selected major function and 
active OPS. 


FAULT SUMM is used to invoke the FAULT 
display. It operates as a single keystroke com- 
mand. The FAULT display can be accessed in 
every major function and OPS. 


GPC/CRT initiates a multistroke keyboard 
entry, allowing the selection of a particular GPC 
to drive an IDP. 


YO RESET attempts to restore a GPC's 
input/output configuration to its original status 
prior to any error detection. It is a command 
initiator and requires a terminator keystroke. 


ITEM is used as a multi-keystroke command 
initiator for changing the value of defined 
parameters or implementing configuration 
changes on a given display (OPS or SPEC). 


EXEC acts as a multi-keystroke terminator to 
command the execution of the action specified 
on the scratch pad line. It is the terminator for 
the initiators above it (GPC/CRT, I/O RESET, 
and ITEM keys). EXEC may also be a single 
keystroke command to enable an OMS burn. 


OPS serves as a multi-keystroke initiator to 
load a desired OPS load from mass memory 
into one or more GPCs. It is also used to 
transition from major mode to major mode 
within an OPS. 


SPEC acts as a multi-keystroke initiator to select 
a defined SPEC or DISP display within a given 
OPS. In addition, this key provides the 
capability to freeze a DPS display. А single 
depression of the SPEC key freezes the display 
so it may be statically viewed. The display will 
remain frozen until another key (other than 
ACK, MSG RESET, or another SPEC) is entered. 
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PRO (Proceed) serves as а terminator to the 
OPS and SPEC keys. The completed command 
sequence initiates the selection of a desired 
OPS, SPEC, or DISP display. 


RESUME is used to terminate a displayed SPEC 
or DISP. The highest level SPEC or DISP is 
cleared and the underlying display is brought 
to the forefront upon depression of this key. 


CLEAR clears the last echoed keystroke from 
the bottom line (scratch pad line) of the DPS 
display. For each depression, one additional 
keystroke is removed, proceeding from right to 
left. After a command sequence is completed, a 
single depression of the CLEAR key will erase 
the static command from the scratch pad line. 


Display Selection Procedures 


The crew can select a variety of DPS displays in 
numerous ways. Some of the different ways to 
select an OPS display and its available SPEC 
and DISP displays are as follows: 


e Selection of the major function is done 
by placing the MAJ FUNC switch (on 
panel C2) associated with the IDP in use 
in the GNC, SM, or PL position. 


e An OPS is loaded from the MMU via a 
three-step keyboard entry. A new OPS 
is called from mass memory by its first 
major mode. The OPS is loaded into the 
GPC that is currently driving the IDP on 
which the keyboard entry is performed. 
Once the OPS is loaded, access is 
provided to major modes in that OPS. 
Major mode displays are advanced by 
the same keyboard command. The steps 
for selecting an OPS display are as 
follows: 


1. Depress the OPS key. 


2. Key in the three numbers of the 
desired OPS. The first digit 
defines the OPS and the next two 
digits specify the major mode. 


3. Depress the PRO key. Once the 
OPS is loaded into one or more 
GPCs, that software сап be 
accessed at any time through any 
IDP in the proper major function. 
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Selection of a major mode does not involve a 
mass memory access. Advancing major modes 
is done by the same keyboard command as 
loading an OPS. The first digit will be the same 
as the OPS number, but the last two digits 
specify the major mode. For example, to go to 
GNC MM 202, enter OPS 2 0 2 PRO. 


Within each OPS, certain SPEC and DISP 
displays are available. The steps for selecting a 
SPEC or a DISP are as follows: 


1. Depress the SPEC key. The SPEC key is 
used in calling both SPEC and DISP 
displays. 


2. Кеуіп the SPEC or DISP number omitting 
all leading zeros. SPEC and DISP 
numbers have three digits. They are 
differentiated by their numbering 
scheme. The display is a DISP only if 
the first digit is a 9, or if the last digit 
is a 6 through 9. To illustrate the 
method for keying in SPEC and DISP 
numbers, DISP number 106 would be 
keyed in as "106", SPEC number 034 
would be keyed "34"; DISP number 
066 would be keyed "66"; and SPEC 
number 001 would be keyed "1." 


3. Depress the PRO key. 


OPS and Major Mode Transitions 


Transitions from major mode to major mode or 
to another OPS are accomplished by either 
automatic transitions or proper command entry. 


е Automatic transitions: Some major 
mode transitions occur automatically, 
usually as a function of some mission 
event. Examples of automatic transi- 
tions are between major modes 101 and 
102 (SRB ignition) and between major 
modes 102 and 103 (SRB separation). 
Selection of an RTLS abort also results in 
an automatic OPS transition. 


® Command entry: Proper command entry 
(OPS XXX PRO) is almost always used to 
transition from one OPS to another. In 
most cases, it is also a legal transition 
operation for proceeding from one major 
mode to the next (e.g.; 301 to 302). 
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Display Sequencing, Overlaying, 
and Retention 


Certain rules have been established for 
proceeding from one display to another. These 
can be categorized into treatment of proper 
display sequencing, the overlaying of current 
displays by new displays, and the display 
retention hierarchy. 


SPEC and DISP Displays 


The hierarchy of overlaying SPECs and DISPs 
makes sense if one remembers that a SPEC 
allows crew interaction and control of 
specialized operations, whereas а DISP 
provides display information only. Both SPECs 
and DISPs overlay the current major mode 
display when called. 


A SPEC need not be previously selected in 
order to call a DISP. If a DISP is active, and 
another SPEC or DISP is called, the current 
DISP is terminated. The terminated DISP can 
only be viewed again by entering its calling 
command once more. 


If a SPEC is selected, and a DISP is called to 
overlay it, the SPEC is retained underneath the 
DISP. If another SPEC is then selected, the 
underlying SPEC as well as the DISP over it is 
terminated. The terminated SPEC can only be 
viewed again if it is recalled. 


The RESUME key is used as a single keystroke 
entry to terminate the SPEC or DISP currently 
being displayed and to restore the underlying 
display. If the display being terminated is a 
DISP, control will be restored to the underlying 
SPEC, or to the OPS display if no SPEC has been 
selected. If a SPEC display is terminated, IDP 
control is restored to the major mode display. It 
is advisable to press RESUME after completing 
viewing any SPEC or DISP to avoid confusion 
and to eliminate locking out certain ground 
command functions that are inhibited when 
certain SPECs are active or underlying a DISP; 
i.e., SM60 and 5М62. The RESUME key cannot 
be used to transition from one major mode 
display to another or to page backwards 
through major mode displays. 
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Display Retention Hierarchy 


* Major mode transitions: Both SPECs 
and DISPs are retained during a major 
mode transition. If a SPEC or DISP is 
overlaying the major mode display, the 
new major mode display can't be seen 
until the overlaying displays аге 
terminated with the RESUME key. 


* Major function change: OPS and SPEC 
displays are retained within their major 
function when major function positions 
are switched. When the crew returns to 
the first major function, the SPEC last 
viewed will appear on the screen. 
Depression of the RESUME key will 
restore the underlying OPS. If no SPEC 
had been selected, return to a major 
function would restore the last major 
mode display. DISP displays are not 
retained at major function switch 
transitions. 


e OPS transition: SPECs, DISPs, апа 
major mode displays are not retained 
through an OPS transition, since this 
involves loading an entirely new 
module of applications software in the 
GPC. The SPECs may be called again if 
they are available in the new OPS. 


Standard Display Characteristics 


Standard Display Features 


Two discrete brightness intensities Юг 
displayed characters are designated "bright" 
and "overbright Тһе bulk of all material is 
displayed 

in the "bright" intensity. Special messages and 
special characters, such as parameter status 
indicators, are displayed in "overbright," which 
appears in a yellow font, to direct the crew's 
attention during their display scan. 


Certain words and messages are designed to 
flash on and off. Fault messages will flash, 
indicating a message that needs to be 
acknowledged. Command  initiators are 
designed to flash until the command is 
completed, and an incorrect keyboard entry will 
result in a flashing "ERR" to the right of the 
erroneous entry. 
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5РЕС питбег 
ОР$ 
питрег 


DISP number 
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2011/000/ 


Display title indicator driver 
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Uplink GPC бэр 
Mission CRT 


timer timer 


UL 1 008/12:12:12 


000/00: 29:12 


S69 FUEL CELL 


MEM/BUS CONFIG READ/WRITE GNC 
1 CONFIG 3(63) DATA 20* BIT SET 22 SEQ ID 24 
2 GPC 12340] COD 21 ВІТ RST 23 WRITE 25 
26 ENG UNITS _ HEX 27* 
STRING 1|71| AD DESIRED ACTUAL 
2|182|28 9 
з | 93 | 30 31 
4 |10 4 | 32 33 
P/L 1/2 |111 |34 35 
36 37 
CRT 1 |12 1/38 39 
2 132 
3 |14 3 | MEMORYDUMP STORE МС-02 
4 |15 0 | 40 START ID 45 CONFIG 
41 NO WORDS 46 GPC 
LAUNCH 1 |16 0 | 42 WDS/FRAME STORE 47 
2 |17 0 DUMP START/STOP 43 
мм 1 181 
2 |192 44 DOWNLIST GPC 1 | MM AREA 
OPS © ENA 49 PL 521 
OPS 3 UPLINK 50 GNC 53 1 
OPS 3 INIT 51 ERR LOG RESET 48 


ITEM 23 —ÀX 


Fault message line 


Scratch pad line 
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Formatting Conventions Common to АП Displays 


Formatting Similarities 


OPS number: The four-digit field in the upper 
left corner of the first line designates the number 
of the OPS display being processed. The first 
digit represents the OPS; the next two digits 
indicate the major mode. The last digit is always 
a "1," and it is not used when making keyboard 
entries. 


SPEC number: Directly to the right of the OPS 
number is a three-digit field. This field displays 
the number of the SPEC overlaying the OPS. 
This field is blank if no SPEC is selected. 


DISP number: The last field in the upper left 
corner represents the DISP number. It is a 
three-digit field. This field is blank if no DISP is 
currently being displayed. 


Display title: Centered on the top line of the 
display is the title of the display. Portions of some 
tiles are dynamic and will specify the mission 
phase. 


Uplink indicator: Directly to the right of the 
display title is a two-space field. When an up- 
link to the GPC is in progress, a flashing "UL" 
will be displayed. Otherwise this field is blank. 


GPC driver: To the right of the uplink indicator 
is a one-digit field. A number in this field indi- 
cates the particular GPC (1, 2, 3, 4, or 5) that is 
commanding the IDP. 
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GMT/MET clock: This field displays time in 
days, hours, minutes, and seconds (DDD/HH: 
ММ:55). The field is updated every second. The 
time displayed may be either GMT or MET 
selectable via a keyboard entry to the SPEC 2 
TIME display. 


CRT timer: Directly below the GMT/MET 
clock is a CRT timer field also displayed in 
days, hours, minutes, and seconds 
(DDD/HH:MM: 55). This field is also updated 
every second, and can be set via a keyboard 
entry to the TIME SPEC display. 


Fault message line: The second line from the 
bottom is reserved for fault messages. Illegal 
keyboard entry messages and systems fault 
messages are displayed on this line. In the case 
of system faults, a number in parentheses to the 
far right on this line indicates the number of 
fault messages that have not been viewed and 
acknowledged (further discussion of fault mes- 
sages is covered in a later section). 


Scratch pad line: The bottom line of the display 
echoes keyboard entries made by the crew. 
Command initiators (OPS, SPEC, ITEM, 
GPC/CRT, and I/O RESET) will flash on the 
scratch pad line until the command is termi- 
nated. The keystrokes remain on the scratch 
pad line in a static mode until (a) a new 
command is initiated, (b) the CLEAR key is 
depressed, or (c) the MAJOR FUNC switch 
position is changed. Keyboard syntax errors 
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detected by the IDP will result in a flashing 
"ERR" on the scratch pad line following the 
keyboard entry. 


Specially Defined Symbols 


These symbols include an asterisk and a set of 
parameter status indicators. Parameter status 
indicators are displayed in "overbright" inten- 
sity for quick recognition. These special 
symbols are defined as follows: 


M: This symbol indicates missing data. It is 
displayed directly to the right of the affected 
parameter. The parameter value may be 
blanked, or the last value received by the GPC 
may be displayed. If data are missing for a 
parameter that has no numerical value 
associated with it, then an M is used to indicate 
the parameter status. 


H: This symbol indicates that a parameter is 
off-scale high. This indicates a transducer limit 
has been reached, and the scale is registering its 
highest possible value. The actual parameter 
being measured may, in fact, be higher than the 
recorded data, but the instrument in use does 
not have the capacity to measure the value. 
Off-scale high indicators do not appear on the 
display until several (normally two) consecutive 
readings have verified this finding. This 
symbol is displayed to the right of the data 
affected. 


L: This symbol indicates off-scale low 
parameters. This means that the parameter 
value displayed is the lowest possible reading 
due to transducer limitations. The actual value 
of the parameter may exceed the displayed 
value, but the range of the hardware is not 
defined to evaluate this reading. As with the 
"H," the off-scale low indicator is not displayed 
until a set number of consecutive readings have 
verified this status. 


Up arrow: This symbol, displayed to the right 
of the affected parameter, indicates a parameter 
driven out-of-limits high. The value displayed 
is a true reading but has equaled or exceeded 
the operational high limit established by the 
software. The fault detection and annunciation 
(FDA) software keeps track of the low and high 
limits for each parameter and annunciates any 
violation of these limits to the crew by 
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displaying the appropriate "up arrow" or "down 
arrow" next to the parameter on the appropriate 
display. 


In the case where the transducer limit is the 
same as the operational limit, the "H" symbol 
overrides the "up arrow" symbol. Several (nor- 
mally two) consecutive readings verify this status 
before the "up arrow" symbol is displayed. 


Down arrow: This symbol indicates that а 
parameter value is equal to or less than the 
operational low limit. The value displayed is 
outside the software limits placed upon the 
parameter. When the software limit established 
is the same as the transducer limit, the "L" 
symbol takes precedence over the "down arrow" 
symbol. A set number of consecutive readings 
verifies this indication before the "down arrow" 
is displayed. 


In addition, the down arrow is used to indicate 
a discrete state that does not agree with the 
nominal state. For example, a high pressure gas 
supply valve state reading "closed" when its 
position is normally "open" would drive the 
"down arrow" symbol. 


The down arrow is also used to indicate that a 
hardware unit has been declared failed by a GPC. 


?: This symbol indicates a redundancy 
management dilemma. That is, if two hardware 
units measuring the same parameter disagree, 
and the software cannot isolate which of the 
two is failed, а "?" will be displayed in both 
places. 


*: This symbol indicates an active state or the 
selected item of mutually exclusive items. 


Item Operations 


Within a given display, certain operations can 
be performed by the crew. Those items that 
may be altered are identified by an item 
number. The item number is a maximum of 
two digits and is placed in such a way that it is 
readily identifiable with the parameter or status 
configuration with which it is associated. When 
item numbering is obvious, item numbers may 
be implied and will not appear on the display. 
Item numbering is sequentially ordered for each 
display. There are never more than 99 items per 
display. The two basic types of manipulations 
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that the crew 


can perform аге 


configuration change and item data entry. 


2011/ /078 


dP/dT-EQ +.00 +. 


02 CONC 
PPO2 3.00 
FAN AP 5.00 


HX OUT T  46H4— 


02 FLOW 

N2 FLOW 

IMU FAN 

ДУ ЕС1 

551 22 

552 22 

553 23 21 

TOTAL AMPS 557 
KW 17 


3.00 


item 


SM SYS SUMM 1 4 000/14:44:12 
000/00 : 00:00 

2/B 
30.1 
30.1 
29.6 


——c 
29.4 


DC VOLTS 1/A 
FC 30.6 
MAIN 30.6 
ESS 29.6 


дођу 
CNTL 1 29.4 


2 29.4 
3 29.4 
000 


2011/ /018 GNC SYS SUMM 1 


29.4 
29.4 


3/с 
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Item Configuration Change 


This operation allows the crew to choose any of 
a number of options or to initiate a specific 
action as defined by the particular display 
format. Typical purposes of this operation 
include selecting or deselecting an item, initiat- 
ing and executing an action, and altering 
software configurations. The procedure used in 
performing an item configuration change 
within a selected display is as follows: 


1. Depress the ITEM key. 
2. Кеуіп the item number. 


3. Depress the EXEC key. 


Item Data Entry 


This operation lets the crew load data into the 
software. Typical purposes include initializing 
parameters, changing software limits, and 
specifying memory locations. The procedure to 
perform an item data entry is as follows: 


1. Depress the ITEM key. 


2. Key in the item number. Item numbers 
are ordered sequentially (1, 2, 3, . . .) on 
each display. They are located next to 
the parameter to which they are 
assigned. Some item numbers must be 
inferred by their surrounding item 
numbers. 


3. Key in a delimiter ("+" or "-") A 
delimiter serves to separate item 
number codes from their correspond- 
ing data. The delimiter whose sign 
corresponds to the sign of the data 
should be used, but if no sign is 
associated with the data, it doesn't 
matter which delimiter is used. A "[ ]" 
after the data field indicates that the 
entry is sign-dependent. 


4. Key in the data. Data size 
specifications depend on the format 
established for that particular data 
load. Usually, the data size will be 
indicated with an underline for each 
digit. As a general rule, leading zeros 
need not be entered. Remember that 
the sign of the delimiter is the sign of 
the data. 


5.  Depress the EXEC key. 
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Multiple Data Entries 


Multiple item configuration changes cannot be 
done; but multiple item data entries can. Multiple 
data entries can be made with separate command 
strings. This is time-consuming, so the software 
allows more than one data entry to be made with 
one command sequence. The procedure is the 
same as above, except step 4 (after data are keyed 
in). Add step 4a to make more than one item data 
entry at once. 


4a. Key in a delimiter. Consecutive data 
entries may be loaded by using a 
delimiter to separate each parameter. 
Item entries are incremented sequen- 
tially so the item number need not be 
entered for each parameter following 
the one already entered. Just hit 
another delimiter, and the next item 
number will appear, ready to receive its 
associated data. To skip an item 
number, hit a delimiter twice. This 
way, any amount of item numbers may 
be skipped until the desired item 
number is reached. 


Both the "+" and the "-" keys can be inter- 
changable as delimiters. However, if skipping 
item numbers, it is a good idea to use the 
delimiter corresponding to the sign of the next 
data entry if there is any sign associated with it. 
Using the sign key corresponding to the next 
data entry ensures that the GPC receives the 
proper data entry. 


A sample multiple item data keyboard entry is: 
ITEM 7 +2+1++2+--2 ЕХЕС 


In this example, Items 7, 8, 10, and 13 have по 
sign associated with them so the sign of the 
delimiters does not matter. There is room for 
four item entries here, but the actual number 
allowed on the scratch pad line is a function of 
the size of the data. 


This entry appears on the scratch pad line of the 
corresponding IDP as: 


ITEM (07) + 2 (08) +1 (10) + 2 (13) - 2 EXEC. 


All item operations will be one of these two 
basic manipulations. However, data size and 
form will differ for each display. 


Remember, only OPS and SPEC displays allow 
item operations. A DISP display does not. 


2. SYSTEMS 
2.6 Data Processing System 


Special Operations and Displays 
GPC/CRT Assignment 


GPC assignment to a certain IDP is determined 
via a predefined table of assignments. The table 
is stored in all the common set GPCs' systems 
software; the crew can manipulate it. There is a 
table for each memory configuration (MC) that 
is valid when that MC is active (loaded in one 
or more GPCs), and the particular major 
function is selected. The table can be changed 
via the GPC MEMORY display (SPEC 0). The 
current GPC driver for an IDP is controlled by 
the МА] FUNC switch. That is, the position of 
the MAJ FUNC switch (GNC, SM, or PL) 
determines the GPC with which the IDP 
communicates. In some cases, a redundant set 
of GPCs is formed for GNC, and the GNC IDPs 
are normally split among them. This is done 
with the predefined table. The table is looked at 
by the GPCs when they are loaded with the 
applications software, and that is when the 
assignments take effect. 


Another way to change the current GPC 
assignment logic is with the GPC/CRT key. 
(The old cockpit configuration consisted of a set 
of CRTs. The key is still labeled GPC/CRT, 
although its function is to assign a GPC to 
command an IDP). The GPC/CRT key allows 
the crew to reassign an IDP to a different GPC 
commander. The steps for selecting a GPC to 
command a given IDP are as follows: 


1. Depress the GPC/CRT key . 


2. Кеуіп the desired GPC number (1, 2, 3, 
4, or 5). 


3. Кеуіп the desired IDP number (1, 2, 3, 
or 4). No delimiter is needed between 
the GPC and the IDP numbers. 


4. Depress the EXEC key. 


An assignment is not executed if the assigned 
GPC does not have the applications software in 
memory to support the IDP in its current major 
function. If the GPC specified by a keyboard 
entry is not a valid assignment, the reas- 
signment does not occur, and the GPC driver 
retains the IDP. Thus, if an IDP is in GNC, and 
an attempt is made to assign a GPC that is not 
in the redundant set to drive it, a redundant set 
(or valid) GPC will drive the IDP instead of the 
invalid GPC. If GPC 4 is the SM machine (nom- 
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inal configuration), it is the only valid GPC to 
drive an ТЮР whose МА] FUNC switch is in SM. 


The payloads major function is usually 
unsupported, which means that none of the GPCs 
have payload applications software loaded. Any 
GPC can be assigned to drive an IDP in an 
unsupported major function. The GPC that was 
driving the IDP in the previous major function 
retains the IDP when it is placed in PL. 


If the keyboard entry specifies a valid GPC, it 
overrides any assignment made by the software. 
The keyboard entry assignment remains in effect 
whenever the MAJ FUNC switch is in a position 
supported by that GPC. A new assignment can 
be made via the keyboard. 


The GPC/CRT key can also be used to isolate 
an IDP from communication with all GPCs. 
This is done by using "0" for the number of the 
GPC. The PASS set can drive only three of the 
four IDPs at one time, so at least one IDP is 
always isolated from PASS. 


The IDP drives a big X over its DPS display to 
remind the crew that the IDP is not receiving 
data. The IDP also annunciates a POLL FAIL 
message to inform the crew that the GPC is no 
longer successfully polling the IDP (not 
attempting to communicate with the IDP). 


Memory Configurations 


After a GPC has been IPL'd, the only software 
resident is the systems software, and the GPC is 
in OPS 0 when moded to RUN. Any appli- 
cations software is loaded in from the MMU 
during an OPS transition. There are two levels 
of applications software: the major function 
base (MFB) and the OPS overlay. The MFB is 
the software common to all OPS in a particular 
major function. For GNC, the MFB contains 
flight-critical software and data that are 
retained from one mission phase to another; 
e.g., the current state vector апа inertial 
measurement unit processing. When a GPC 
transitions from one OPS to another in the same 
major function (e.g., from GNC OPS 1 [ascent] 
to OPS 2 [orbit]), the MFB remains in main 
memory, and only the OPS overlay is loaded 
from the MMU and written over the old OPS. 
Of course, when the major function changes 
(e.g, when GPC 4 is transitioned from GNC 
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OPS 1 to SM OPS 2), a new МЕВ is loaded from 
the MMU along with the OPS overlay. 


The controls for performing an OPS transition 
(i.e., loading a new memory configuration into 
the GPC from the MMU) are on the GPC 
MEMORY display (SPEC 0), which is also the 
OPS 0 OPS display. Item 1 determines the 
memory configuration (CONFIG) to be loaded. 
Currently, there are eight different memory 
CONFIGs, besides memory CONFIG 0, which is 
post-IPL OPS О(по applications software loaded). 


GNC OPS 1 and 6 combined (ascent and aborts) 
GNC OPS 2 (on orbit) 
GNC OPS 3 (entry) 


SM OPS 2 (on orbit) 
SM OPS 4 (on orbit [not used]) 
PL OPS 9 (preflight) 


GNC OPS 8 (оп orbit checkout) 
GNC OPS 9 (preflight/postflight) 


OND ZANAWNEK 


Memory Configurations 


Nominal Bus Assignment Table 


Associated with each memory configuration is a 
nominal bus assignment table (NBAT). It is 
displayed via items 7-19 on SPEC 0 whenever a 
memory configuration is entered, and it tells 
which GPCs are in the target set and which 
GPCs are to be in command of each data bus. 
The nominal assignments are already loaded in 
GPC main memory preflight. However, these 
bus assignments may be changed any time, 
including when an OPS transition is performed. 
A typical NBAT is shown on SPEC 0 GPC 


MEMORY for GNC OPS 3. 
2011/000/ GPC MEMORY 1 008/12:12:12 
000/00: 29:12 
MEM/BUS CONFIG READ/WRITE GNC 
1 CONFIG 3(63) DATA 20* BIT SET 22 SEQ ID 24 
2 GC 12340| COD 21 ВІТ RST 23 WRITE 25 
26 ENG UNITS__ HEX 27* 
STRING 1 | 71| ADD ID DESIRED ACTUAL 
2|82]|28 9 
з | 93| 36 31 
4 110 4 | 32 33 
P/L 1/2 |11 1 | ЗА 35 
36 37 
CRT 1 |12 1] 38 39 
2 |132 
3 |14 3 | MEMORYDUMP STORE МС-02 
4 115 6 | 40 START ID 45 CONFIG 
41 № WORDS 46 GPC 
LAUNCH 1 |16 0 | 42 WDS/FRAME STORE 47 
2 |17 0 | DUMP START/STOP 43 
мм 1 |181 
2 |192 44 DOWNLIST GPC 1 | MM AREA 
OPS 0 ENA 49 PL 521 
OPS 3 UPLINK 50 GNC 53 1 
OPS 3 INIT 51 ERR LOG RESET 48 SM 541 
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Sample NBAT Data on GPC MEMORY 
Display (SPEC 0) 
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e Items 2-6 determine which GPCs will be 
in the OPS. They are referred to as the 
"target" GPCs. In this case, GPCs 1-4 are 
in a redundant set. If a GPC is not to be 
in that OPS, a 0 is entered in that GPC's 
item number, which is one more than the 
GPC number. (Item 2 is for GPC 1, etc.) 


e The commanders of the flight-critical 
data buses or strings are entered in 
items 7-10. (String 1 is ЕБІ and FAT, 
etc.) In this case, each GPC is set to 
command its same-numbered string. 


e The two PL buses are assigned together. 
For OPS 1 and 3 they are assigned to 
GPC 1 via item 11 in case the BFS fails. 
When the BFS is in RUN (as it is for 
entry), it commands the PL data buses. 


® The “CRT” portion of the NBAT refers to 
which GPCs are assigned to command 
the IDPs over the DK bus (the word CRT 
remains from the previous CRT cockpit). 
IDPs 1, 2, 3 are assigned to GPCs 1, 2, 3 
respectively, via items 12-14. Since the 
PASS can only control three IDPs at a 
time, no GPC is assigned to IDP 4 during 
entry. Note that IDP assignments are for 
a particular major function only. 


e The launch data buses are assigned via 
items 16 and 17. Since they have no 
function during entry, they аге 
deassigned. 


e Items 18 and 19 show that GPC 1 will 
command mass memory bus 1 for the 
OPS 3 transition, and GPC 2 will com- 
mand mass memory bus 2, either if the 
transaction fails on mass memory bus 1 
or if MMU 2 is prime selected on SPEC 1 
DPS UTILITY. 


MMU Assignment 


Because there are two identical MMUs, there 
must be a method to tell the GPCs which one to 
use for a particular transaction. This is done on 
DPS UTILITY SPEC 1 display via items 1 
through 8. Only one MMU (and its data bus) is 
assigned to each major function. A post-IPL 
OPS 0 GPC also has an MMU assigned to it for 
requesting freeze-dry software for a memory 
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store. This display is initialized with all 
assigned to MMU 1, and execution of any of the 
item numbers causes the appropriate MMU to 
be assigned. Note that each of the pairs of item 
numbers is mutually exclusive. 


When a GPC needs to access mass memory, this 
table tells it which MMU to use. For example, 
the SM GPC may need to call a roll-in SPEC or 
take a checkpoint (discussed later). In the case 
of OPS transitions, if the MMU selected is busy 
or fails twice, then the other is automatically 
tried. For а GNC OPS transition where a 
redundant set is involved, one GPC is assigned 
to each mass memory bus via items 18 and 19 
on SPEC 0 GPC MEMORY. The indicated GPC 
will command the mass memory bus selected 
by item 1 or 2 on SPEC 1 DPS UTILITY, then the 
other GPC will command the next mass 
memory bus if the first transaction fails. Of 
course, all GPCs in the redundant set will be 
listening over both buses and receive the overlay. 

2011/001/ 


DPS UTILITY 1 008/12:12:12 


000/00:25:12 
MMU ASSIGN PORT ASSIGN 
12 БЕС UL CNTL 

GNC 1* 
SM 3* 
PL 5* 3 
OPS 0 7* 


STRING 1 
2 


4 
P/L 1/2 23* 24 


IPL SOURCE SW 
MMU STATUS MASK 38* 
1 RDY 
2 RDY VAR PARAM ID LIST 

25 

MMU SOURCE/BUS G3 ARCHIVE 
LOAD 48 
RETRIEVE 49* 


GROUND OPS 
GSE POLL ЕМА 50 
SM GSE INH 51 
SM C/O ENA 52 
GNC C/O ENA 53 
BFC C/O ENA 54 
ALT PL9 TB 55 
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DPS UTILITY Display (SPEC 1) 


Software Memory Source Selection 


During an initial program load (IPL), an MMU 
is selected as the software source via the IPL 
SOURCE switch on panel O6. This switch is a 
three-position toggle switch that will be either 
in the MMU 1 or MMU 2 position during the 
IPL sequence. At all other times, this switch 
will nominally be in the OFF position. 


The controls for selecting the memory source 
for an OPS transition and the bus over which it 
is loaded into the GPCs are on SPEC 1 DPS 
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UTILITY (items 9 through 11). Тһе display is 
initialized with item 9 selected, which is almost 
always used. As part of the GPC status ex- 
changed at common set sync, each GPC 
exchanges its current resident memory con- 
figuration. When a request is made for a 
memory configuration, the software determines 
whether or not another GPC already has the 
requested OPS or a current major function base. 
If another GPC already has any of the requested 
software, the lowest numbered such GPC will 
be used as a source for the other GPCs. Such а 
GPC-to-GPC overlay of software will be done 
over the mass memory data buses. An overlay 
that is not available from a GPC will be loaded 
from an MMU. Note that the major function 
base may come from another GPC and the OPS 
overlay from mass memory. For transitions to 
ОР5 3, the G3 archive (stored in the upper 128 К 
of main memory prelaunch) is simply copied to 
lower memory and executed. 


BACKUP 


(538) 


(537) 
TERMINATE 


ІРІ SOURCE 
MMU 1 


NITIAL PROGRAM LOAD 


(385) 


E © esan TES 


| | = | | | | | | 
(058) 10510) (0511) (05121 


MODE 


1 
3 4 5 
RUN 

[i] 


[О] © ТӨ] EIG 


(528) (349) (550) 


5 
T 
8 
у 
HALT 
PAUSE] © 


IPL SOURCE Switch on Panel 06 


If there is a problem with both of the mass 
memory data buses, then item 11 may be se- 
lected if there is a GPC source for both overlays. 
In this case, the GPC-to-GPC overlay is done 
over the launch data buses. 


Memory reconfiguration may be forced from an 
MMU, regardless of other GPC sources, by 
selection of item 10 on the DPS UTILITY dis- 
play. In this case, whether both are required or 
not, both the major function base and the OPS 
overlay will be loaded from mass memory. 
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This would only be used if the software in a 
current GPC was suspect for some reason. 


If there is no usable GPC source and the 
selected MMU is off or being used for another 
memory transaction, the class 3 fault message 
OFF/ BUSY MMU 1 (2) is initiated. The current 
status of each MMU is shown on the DPS 
UTILITY display as either RDY (ready to 
respond) or BSY (off or currently responding to a 
GPC command). 


Resetting I/O Configurations 


When a GPC detects an error or is missing data 
from a piece of equipment, a fault message will 
be displayed on the appropriate DPS displays, 
the SM ALERT light and tone will be activated, 
and further attempts by the GPC to 
communicate with the equipment will be 
terminated. Two common causes of detected 
errors or missing data are the powering down 
of equipment or an error in a data transmission. 
In these two cases, if the equipment is to be 
powered up, or if the error has been corrected, it 
is desirable to restore the GPC's data input to 
the nominal configuration. Restoring input is 
done through the I/O RESET key in the affected 
major function. If an I/O RESET is performed 
only on a GNC GPC, the entire redundant set of 
GNC GPCs will be restored to nominal I/O 
configuration. If it is performed on the SM 
GPC, only the SM GPC's I/O configuration will 
be restored to nominal. To reset I/O 
configurations, the procedure is to: 


e Select desired MAJ FUNC. 
e Depress the I/O RESET key. 
e Depress the EXEC key. 


If the powered down equipment has been 
powered on, or if a problem with a piece of 
equipment has been fixed, an I/O RESET 
resumes communication, and does not cause 
another fault message annunciation. If the GPC 
still has a problem with any piece of assigned 
equipment, a fault message reannunciates after 
an I/O RESET. This termination of attempts by 
the GPC to communicate with its assigned 
equipment is called а commfault (i.e., the input 
element has been bypassed by the GPC) and the 
resultant loss of input data to applications 
software is also referred to as а commfault. 
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Systems Summary Displays 


Systems summary displays provide general 
systems status information that can be accessed 
quickly to aid immediate diagnosis of a 
problem. They are designed to support the 
caution and warning (C/W) matrix located on 
panel Е7. When a C/W alarm occurs, the crew 
can call a systems summary display that has 
general information from several systems to 
pinpoint the problem to a specific system, then 
continue troubleshooting the problem on 
system-specific SPECs, DISPs, and hardware 
panels. The systems summary displays are 
DISPs and provide information only. 


The systems summary displays are major 
function-specific and are called with the SYS 
SUMM key. If an IDP's MAJ FUNC switch is in 
GNC, and the SYS SUMM key is pressed, GNC 
SYS SUMM 1 will appear on that IDP. GNC 
SYS SUMM 1 is DISP 18 so it may also be called 
with a SPEC 18 PRO, but it is faster to use the 
SYS SUMM key. 


There are four PASS systems summary 
displays: GNC SYS SUMM 1, GNC SYS SUMM 
2, SM SYS SUMM 1, and SM SYS SUMM 2. 


The SYS SUMM key is a toggle function in each 
major function. In SM on-orbit, hitting SM SYS 
SUMM will cause SM SYS SUMM (DISP 78) to 
appear on the IDP. If SYS SUMM is depressed 
again, SM SYS SUMM 2 (DISP 79) will appear, 
and if SYS SUMM is depressed once more, SM 
SYS SUMM 1 reappears. 


The same toggle function exists in GNC 
between GNC SYS SUMM 1 (DISP 18) and GNC 
SYS SUMM 2 (DISP 19). 
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PASS SM SYS SUMM 2, available in 
SM OPS 2 


Fault Detection and Annunciation 


Five classes of alarms have been established. 
Class 1,Emergency, has no interface with 
software. Class 2, Caution and Warning (C/W), 
is the second highest alarm class. It is divided 
into primary (hardware-driven) and backup 
(software-driven) systems. An alarm of the 
software-driven class will result in the 
annunciation of the BACKUP C/W ALARM light 
on the C/W matrix on panel F7, the MASTER 
ALARM lights, and an associated tone. In 
addition, a fault message will be displayed 
upon the fault message line of the DPS display. 
Class 3, Alert, triggers the SM ALERT light and 
corresponding tone. А fault message is 
displayed on the fault message line. Class 5, 
Operator Errors, is the lowest priority alarm 
and is caused only by a crew entry error. It 
results in an ILLEGAL ENTRY fault message 
being displayed. Class 0, Limit Sense, provides 
a status indicator (down arrow, up arrow) to the 
right of the affected parameter on an 
appropriate IDP. No fault message, tone, or 
light is triggered. 


The output of a fault message to the fault 
message line results in several indications 
requiring crew interface. Although generally 
the crew keyboard responses are similar, the 
effects of these responses differ for each class 
alarm. 


The crew response to a class 2 backup fault 
message is: 


1. Depress the MASTER ALARM 
pushbutton indicator. This will 
extinguish the MASTER ALARM light 
and caution and warning tone. 


2. Depress the ACK key (on the keyboard). 
The fault message will cease flashing. 
If the crewmember can examine the 
message while it flashes, this step is 
unnecessary. Depress the ACK key 
again to look at the next message in a 
stack if required. 


3. Depress Ше MSG | RESET key. 
Depression of this key removes the 
fault message from the fault message 
line. In addition, the BACKUP C/W 
light is extinguished. (Нагауғаге- 
driven lights remain on until the 
problem is corrected.) 


The crew response to a class 3 fault message is: 


1. Depress the ACK key. This will cause 
the fault message to become static. 
Depressing the ACK key will also 
extinguish the SM ALERT light and 
tone. (Ihe tone duration is set to a 
crew-selected length and may have 
stopped before the ACK key is pressed.) 
Depress the ACK key again to look at 
the next message in a stack if required. 


2. Depress the MSG RESET key. This will 
remove the fault message from the 
fault message line. If the ACK key 
had not been depressed, the MSG 
RESET key would extinguish the SM 
ALERT light and tone. 
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A class 5 fault message displays a flashing 
"ILLEGAL ENTRY" on the fault message line. 
The crew response is simply to depress the 
MSG RESET key. This clears the fault message 
from the fault message line. The ACK key will 
not clear an "ILLEGAL ENTRY." It will cause 
messages stacked under the "ILLEGAL ENTRY" 
display to be acknowledged and cleared. 


Some illegal keyboard entries are detected 
by the IDP before being sent to the GPCs. When 
this occurs, a flashing "ERR" appears 
immediately to the right of the erroneous entry 
on the scratch pad line. The crew response is 
simply to depress the CLEAR key. Upon 
depression of the CLEAR key, the "ERR" and 
the last keystroke will disappear. Subsequent 
depressions of the CLEAR key will remove 
single keystrokes, proceeding from right to left. 
This feature enables the crew to CLEAR back to 
the portion of the command that was incorrect, 
correct it, and proceed. This type of error is not 
identified by class, since it is not GPC-detected 
and is known simply as an IDP-detected error. 


Fault Messages 


Fault messages associated with alarm classes 2, 
3, and 5 follow a standard format of five fields. 
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The major field is a 14-character field. The first 
three characters identify the display on which 
more information about the annunciated failure 
can be found. An S or a G, followed by a two 
digit number, indicates the major function (G 
for GNC and S for SM) and the number of the 
SPEC or DISP. If no display is associated with 
the fault, this field is blank. In the example 
below, "S88" is the CRT ID and means that 
information on the fault can be found on SPEC 
88 in SM. 


The remaining characters identify the problem 
or subsystem group associated with the fault. 
In the example, "EVAP OUT T" is the FAULT 
portion of the major field and indicates a fault 
in the flash evaporator subsystem. 


The minor field is a four-character field that 
further identifies the fault. It will specify the 
subdivision, direction, location, parameter, or 
specific unit of the subsystem or problem identi- 
fied in the major field. In the example fault 
message, "1" is the minor field message and 
means that the temperature sensor 1 is the area 
in which the fault was detected. 


The C/W field is used only with caution and 
warning class 2 backup messages. An asterisk 
appears in this column across from the corre- 
sponding fault to denote that the condition is a 
class 2 backup alarm. 


The GPC field identifies the GPC that detected 
this fault. This characteristic aids the crewmem- 
ber in locating or identifying internal GPC or 
I/O errors. 


The far right field is the TIME field. This field 
indicates the time at which the fault occurred. 
The time is MET and is displayed in hours, 
minutes, and seconds (HH:MM:SS). 


A complete listing of all possible fault messages 
can be found in the Flight Data File Reference 
Data Book and in Section 2.2. 


A class 5 alarm is annunciated by an "ILLEGAL 
ENTRY" in the major field, and all other fault 
message fields are blank. When a class 5 
message is received, it is displayed 
instantaneously on the fault message line of the 
IDP’s DPS display where the error occurred, 
rather than on all IDPs like class 2 and 3 errors. 


2.6-46 


То get rid of the class 5 message, а MSG RESET 
must be done to the IDP where the error 
occurred. Class 2 backup and class 3 messages 
are extinguished by a MSG RESET on any IDP. 


The Fault Summary Display 


A historical summary of class 2 backup and 
class 3 fault messages is provided via the 
FAULT display (DISP 99). Class 5 errors are not 
displayed as they are caused by illegal crew 
entries to a single IDP. The FAULT display is a 
DISP available in all OPS. It is selected for 
viewing by depression of the FAULT SUMM key. 
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FAULT Display (DISP 99) 


The PASS fault summary display consists of up 
to 15 fault message lines. They appear in 
reverse chronological order. The oldest 
message appears on the bottom line. When a 
new fault message is generated, it appears on 
the top line. The other messages are pushed 
down, and the 15th message (the oldest) 
disappears. 


The only difference between the fault messages 
on the FAULT display and the fault message on 
the fault message line is the TIME field. On the 
FAULT display, the time field includes days as 
well as hours, minutes, and seconds (DDD/ HH: 
ММ:55). 


Sometimes, a subsystem failure or malfunction 
results in the output of several fault messages, 
some of which may be identical. The fault 
detection and annunciation logic can prevent the 
annunciation of identical fault messages. When а 
fault message is generated, its major and minor 
fields are compared to those of the top message 
of the display. If the fields are the same, and if the 
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new fault message has occurred within a 4.8 
second window, the new message is inhibited. 


The last message displayed on the fault message 
line of any DPS display is not necessarily the 
most recent fault message. Unless the fault 
message line was cleared with a MSG RESET, 
the crewmember will not see new messages that 
came in after the flashing or frozen message. In 
that case, the crewmembers can see if a new 
message has been annunciated by looking at a 
two-character field, which is called the buffer 
message indicator and is located in the last field 
on the far right of the fault message line. 


The buffer message indicator serves to indicate 
the number of messages in the fault buffer on 
the FAULT display since the last MSG RESET. 
This number includes class 2 backup and class 3 
messages only. Class 5 messages and the 
currently displayed messages are not included 
in this counter. The number is enclosed by 
parentheses. Ш no fault messages are in the 
stack, this field is blank. To view any of these 
messages, the crewmember may depress the 
ACK key to display subsequent messages or 
look at the FAULT display. A MSG RESET 
clears both the fault message line and the buffer 
message indicator. 


In addition to using the FAULT SUMM key, the 
FAULT display may also be selected by the 
keyboard entry "SPEC 99 PRO." However, this 
command will clear all fault messages from the 
FAULT display and the fault message lines. 
This capability is useful if and when the fault 
messages displayed are no longer significant 
(i.e., they are old, or they have been dealt with). 


Crew Software Interface with the BFS 


The crew software interface with the BFS is 
designed to be as much like PASS as possible, 
but there are some differences. This section 
covers the differences between the PASS's and 
BFS's crew and ТЮР interfaces. Ш something 
is not mentioned in this section, it can be 
assumed to operate the same as the PASS 
interface. 
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BFC CRT Switches 


Panel C3 contains two switches relevant to BFS 
operations. The BFC CRT DISPLAY switch is a 
two-position ON/OFF switch. In the ON 
position, the IDP(s) specified by the BFC CRT 
SELECT switch is driven by the BFS computer. 
(The BFC CRT SELECT switch controls IDP 
assignment to the BFS computer.) The switch 
is read by the GPC only when the BFC CRT 
DISPLAY switch is in the ON position. The BFC 
CRT SELECT switch has three positions. In 
each position, the first digit is the IDP 
commanded by the BFS pre-engage. Post- 
engaged, the BFS also commands a second IDP 
indicated by the second number. For example, 
when the BFC CRT SELECT switch is in the 1 + 
2 position, 
IDP 1 is connected to the BFS GPC prior to 
engaging the BFS. After the BFS is engaged, 
this switch position allows the BFS computer to 
command both IDP 1 and IDP 2. During ascent 
and entry, one forward IDP will normally be 
assigned to the BFS via the BFC CRT SELECT 
switch. The nominal position of the switch is 
the 3+1 position. However, this switch position 
may be changed at any time, pre-engage or 
post-engage. If the BFS is engaged with the BFC 
CRT DISPLAY switch OFF, the BFS will 
automatically assume command of IDPs 1 and 
2. IDP 4 is typically assigned to the BFS as well 
via a GPC/CRT assignment (mission specific). 
No set of BFC CRT switches exists for the IDP 4. 


BFS Functions of the MAJ FUNC Switch 


The MAJ FUNC switches on panels C2 and 
R11L are also functional for the BFS. However, 
the display data and functional software 
accessed by the three-position switch are 
slightly different. The BFS functions of the MAJ 
FUNC switch are defined as follows: 


® GNC: Flight critical software including 
limited guidance, navigation, and con- 
trol software is contained in this major 
function. The BFS GNC major function 
contains only that software necessary 
for safe orbital insertion and return, 
including ascent abort logic. 
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e SM: This major function contains 
limited nonredundant systems manage- 
ment and payload software. There is no 
room in the BFS for the redundancy 
management found in PASS. When the 
MAJ FUNC switch is set in the SM posi- 
tion, the THERMAL display is invoked. 
This display is unique to the BFS. 


• PL: This major function is not 
functional for the BFS. Should the MAJ 
FUNC switch be set in this position, no 
display change would occur. If the BFC 
CRT DISPLAY switch is turned on, 
allowing the BFS to drive an IDP 
already in the PL major function, the 
DPS display will be blank except for 
time and GPC driver fields because the 
BFS has no software to support this 
major function. 


BFS ENGAGE Pushbutton 


The BFS ENGAGE pushbutton is located on the 
commander's and pilot's rotational hand con- 
trolers (RHCs). During the dynamic flight 
phases (ascent and entry), the commander and 
pilot usually rest a hand on or near the RHC. In 
this way, BFS engagement can occur as quickly 
as possible. If the crew delays engagement 
during these flight phases, they could lose 
control of the vehicle, or the BFS' navigation 
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calculations could degrade very quickly so that 
control would be essentially lost after 
engagement. 


Some force (8 Ib) is required to depress this 
pushbutton to prevent inadvertent engages. 
While on-orbit, the pushbutton is essentially 
disabled by reconfiguring the BFS OUTPUT 
switch. The BFS cannot track PASS while it is in 
OPS 2 and is moded to HALT on-orbit. If the 
BFS needs to be engaged on-orbit, the BFS must 
be "awakened", and the only software that will 
be of any use is entry and systems management 
software. 


Keyboard and Display Differences for the BFS 


The keyboard operates exactly the same way for 
the BFS as for the PASS. А few additional 
capabilities need to be mentioned. 


e The GPC/CRT key: In addition to the 
BFC CRT DISPLAY switch, this key 
provides the capability to assign an IDP 
to (or isolate an ТЮР from) the BFS GPC. 
Both methods can be used interchangea- 
bly, but as long as the ВЕС CRT 
DISPLAY switch is working, it is the 
fastest method of allowing the BFS to 
drive an IDP or to change BFS IDPs. 
The BFC CRT DISPLAY switch allows 
PASS to automatically begin driving the 
IDP again when the BFS is turned off. 
When the BFS is assigned an IDP with 
the GPC/CRT key, it is the same as 
deassigning that screen from PASS with 
a GPC/CRT 0X EXEC. PASS must be 
reassigned to resume commanding of 
that IDP. 


• Тһе BFS INDICATOR: When the BFS is 
commanding an IDP, the BFS indicator 
will appear on that IDP’s DPS display. 
On the second line of every BFS display 
a three-character space field has been 
reserved for the message "BFS." This 
field is located directly below the GPC 
indicator. The BFS indicator 15 
displayed in the overbright intensity 
and is intended to prevent possible 
confusion of a PASS display with a BFS 
display. Often the BFS display will be 
identical ог very close to the 
corresponding PASS display. 
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BFS Display Sequencing 


The BFS is designed to operate in the same 
manner as the PASS where possible. BFS 
requirements, however, demanded a distinction 
be made between BFS pre-engage and BFS post- 
engage major mode transitions and associated 
display sequencing. 


BFS pre-engage major mode display sequencing 
is either automatic, or it may be performed in 
the same manner as that of the PASS. Before 
the BFS is engaged, the BFS is listening to 
keyboard inputs made to the PASS controlled 
IDPs across the display/keyboard (DK) buses 
and updating its software accordingly. This is 
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called DK listening and the BFS can hear PASS 
item entries, PASS major mode transitions, and 
PASS GPC/CRT assignments. On the other 
hand, the PASS doesn't know that the BFS 
exists, so it never DK listens to the BFS. 
Therefore, BFS major mode transitions are 
performed automatically as a function of the 
major mode transitions performed on a PASS 
keyboard. If the BFS does not follow the PASS 
major mode transitions, then the BFS must 
receive a manual OPS XXX PRO. 


ВЕБ post-engage major mode display 
sequencing is the same as that of the PASS. 
After the BFS is engaged, the BFS GPC is on its 
own. It no longer listens to the PASS GPCs. 
Therefore, major mode display sequencing has 
been designed to be the same as that of the PASS. 


Three operational sequences are defined for BFS 
СМС; one operational sequence is defined for 
the BFS SM. Transactions to and from these 
OPS displays differ considerably from the 
PASS. BFS keyboard and DPS display 
peculiarities are outlined as follows: 


• BFS GNC OPS 0 - ВЕБ MEMORY 
display: This display is forced to the 
DPS display when BFS is not processing 
either GNC OPS 1 or 3. Nominally, this 
occurs prior to ascent and again prior to 
entry. This display corresponds to the 
PASS GPC MEMORY display and 
performs the same functions for the BFS. 
It also performs some of the same 
functions as PASS SPEC 2, the TIME 
SPEC, in that time updates can be 
performed along with selection of GMT 
or MET to be displayed. GPC 
MEMORY is the default display for 
PASS OPS 0, and the BFS MEMORY 
display is the default display for BFS 
GNC OPS 0. 


е BFS GNC OPS 1 and 6 - Ascent: This 
OPS must be manually selected via a 
keyboard assigned to the BFS prelaunch. 
BFS GNC OPS 1 is available for use 
during the ascent portion of the mission. 
The OPS 6 transition is automatic upon 


0001/000/ BFS MEMORY 5 008/12:12:12 
BFS 000/00:29:12 
READ/WRITE 
DATA 1* BIT SET З SEQ ID 5 
CODE 2 BIT RST 4 WRITE 6 
7 ENG UNITS HEX 8* 
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MEMORY DUMP LAUNCH BUS 126 TFL ЕМА 
21 START ID 2 27 29 
22 NUMBER WDS OFF 28* 
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BFS MEMORY Display 


е BFS GNC OPS 3 - Entry: This OPS must 
be manually selected from BFS GNC 
OPS 0 or BFS GNC OPS 1. BFS GNC 
OPS 3 is available for use during the 
entry portion of the mission. It is a legal 
transition to go from the BFS GNC OPS 
1 to BFS GNC OPS 3 (for aborts), but 
nominally, the transition will be from 
BFS GNC OPS 0. In both cases, the 
manual keyboard entry "OPS 301 PRO" 
is required. 


The major mode displays for BFS OPS 1, 3, and 
6 are similar, if not identical, to their PASS 
counterparts. A complete listing of PASS and 
BFS displays can be found in the DPS Dictionary. 


BFS Special Operations and Displays 


In the pre-engaged mode, the BFS GPC 
performs BCE and MDM bypasses when PASS 
data are bypassed, or it sets its own bypasses. 
The I/O RESET command when made via the 
BFS keyboard restores those I/O configurations 
set by the BFS GPC. That is, a BFS "I/O RESET 
EXEC" restores the bypasses set by the BFS GPC. 
In addition, the I/O RESET operation attempts to 
synchronize the BFS with the PASS GPC listen 
commands so the BFS can track PASS. 


Post-engage, the only bypasses set are those 
detected by the BFS GPC. The "I/O RESET 


abort selection with the ABORT rotary EXEC" command functions to restore those 
switch and pushbutton, or an OPS 601 bypasses. 
PRO may be used. 
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Тһе BFS systems summary displays operate the 
same way the PASS displays work. The BFS 
display numbers are the same as their PASS 
counterparts and some of the displays 
themselves are identical. However, three of the 
BFS SYS SUMM displays are unique to the BFS. 


e GNC SYS SUMM. The GNC SYS 
SUMM consists of two DISPs. GNC SYS 
SUMM 1 is display format and content 
unique to BFS. It is called via the SYS 
SUMM key or by the command "SPEC 
18 PRO." GNC SYS SUMM 2 is identical 
to the GNC SYS SUMM 2 display 
available in the PASS OPS 2 and 8. It is 
called by the command "SPEC 19 PRO" 
or by depressing the SYS SUMM key 
twice. 
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BFS GNC SYS SUMM 1, available in GNC 
OPS 1, 6, and 3 (Unique to BFS) 
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BFS GNC SYS SUMM 2, available in GNC 
OPS 1, 6, and 3 (Identical to PASS GNC SYS 
SUMM 2 except shaded lines) 
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е SM SYS SUMM. There аге two SM SYS 
SUMM displays. SM SYS SUMM 1 is 
identical to the PASS SM SYS SUMM 1, 
while BFS SM SYS SUMM 2 is a unique 
display. They are called in the same 
manner as the PASS SM SYS SUMM 
displays. 


e THERMAL. This is a systems summary 
DISP available as the SM OPS 0 display 
in BFS. It is forced to the screen anytime 
the MAJ FUNC switch is placed in the 
SM position (unless an SM SPEC is 
called up over it). This display is 
unique to the BFS. It cannot be obtained 
with a SPEC key, and it never requires a 
keyboard entry. 
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BFS SM SYS SUMM 2, available in SM OPS 0 
(unique to BFS) 


BFS Fault Messages 


Several crew interface characteristics of fault 
annunciation in the BFS differ from those in the 
PASS. 


e The BFS FAULT display. The BFS 
FAULT display functions in the same 
manner as the PASS. The BFS FAULT 
display is composed of 20 fault lines as 
compared to 15 in the PASS. The C/W 
field displays an asterisk when the 
message annunciated is a class 2 backup 


alarm. The BFS FAULT display 
provides a history of only class 2 backup 
and class 3 messages annunciated by the 
BFS GPC itself. 


BFS Unique CRT IDs. In BFS SM, all 
messages referring to SM SYS SUMM 1 
or SM SYS SUMM 2 are indicated by the 
CRT IDs SM1 and SM2. Fault messages 
referring to the THERMAL display are 
indicated by the CRT ID SMO. 
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DPS Summary Data 


The DPS combines various hardware 
components and self-contained software to 
provide computerized monitoring and 
control. 


DPS hardware includes 5 GPCs, 2 modular 
memory units, a data bus network, 20 
MDMs, 4 IDPs, 11 MDUs, апа other 
specialized equipment. 


Each of the five GPCs consists of a CPU and 
an IOP stored in one avionics box. During 
ascent/entry, four of the GPCs are loaded 
with identical PASS software; the fifth is 
loaded with different software, the BFS. 


The data bus network transfers data between 
the GPCs and vehicle systems. There are 
seven types of data buses: flight-critical, pay- 
load, launch, mass memory, display/key- 
board, instrumentation/ PCMMU, and 
intercomputer communication. 


The 13 DPS MDMs convert data to 
appropriate formats for transfer between the 
GPCs and vehicle systems. 


Two modular memory units provide bulk 
storage for software and data. 


Four IDPs, 11 MDUs, and associated key- 
boards provide the means for flight crew 
interaction with the GPCs. 


The two types of DPS software, system 
software and applications software, combine 
to form a memory configuration for a specific 
mission phase. 


The system software is operating software 
that always resides in GPC main memory. 


The applications software performs the 
functions required to fly and operate the 
vehicle. It is divided into three major 
functions: guidance, navigation, and control 
(GNC); systems management (SM); and 
payload (PL). 
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Major functions are divided into mission 
phase oriented blocks called operational 
sequences (OPS). 


OPS are further divided into blocks called 
major modes (MM), which relate to specific 
portions of a mission phase. 


There are three levels of DPS displays: major 
mode or OPS, specialist (SPEC), and display 
(DISP). 


The four PASS GPCs control all СМС 
functions during  ascent/entry mission 
phases; the fifth GPC is loaded with backup 
flight system (BFS) software to take over in 
case of PASS GPC failure. 


The BFS contains a limited amount of 
software; there are some operational differ- 
ences between BFS and PASS. 


The BFS is engaged by pushbutton on the 
rotational hand controller. 


A GPC FAIL detection will display a class 2 
GPC FAULT message with illumination of 
the MASTER ALARM. The GPC STATUS 
matrix (sometimes referred to as the 
computer annunciation matrix (CAM)) on 
panel O1 lights to indicate failure votes; any 
time a yellow matrix light is illuminated, the 
GPC caution and warning light on panel F7 
also lights. 


Most DPS control switches are located on 
panels O6 and C2. Others may be found on 
panels C3, R11L, F2, БА, F6, and F7. 


DPS displays relevant to the DPS are: 
GPC/BUS STATUS (SPEC 6, GPC 
MEMORY (SPEC 0), DPS UTILITY (SPEC 1), 
and TIME (SPEC 2). 
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DPS Rules of Thumb 


Always HALT fail to sync GPCs and reassign 
their IDPs to good GPCs to avoid inadvertent 
entries (NBATs/restrings, burn targets, etc.). 


Before OPS transitions and restrings, always 
verify the appropriate NBAT is what you 
want it to be; never assume that it is correct! 
Also check the proper major function and 
GPC switch configuration. 


Make sure you have the correct memory 
configuration called up before you start 
making NBAT changes. 


During OPS transitions, keep "hands off" 
everything, including all switches and 


keyboard entries. 


Clear the Fault Message line as soon as you 


have seen the message or use the ACK key to 
display subsequent messages. 


Post BFS engage, check to ensure that all 
active PASS GPCs have recognized the 
engage (both MODE and OUTPUT talkbacks 
are barberpole). If not, take the offending 
GPC to HALT (or if this does not work, 
power it OFF) immediately to avoid I/O 
problems on the flight critical strings. 


It is a very good idea to resume SPECs and 
DISPs when not using them or before moving 
the major function switch. 


It is important to be able to identify GPC 
failures. The information you provide will affect 
Mission Control analysis and its ability to plan 
for subsequent failures (both DPS and non- 
DPS). 
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e Always hard assign IDPs (both PASS and 


BFS) via PASS IDPs (BFS will DK listen). If 
you assign BFS to drive an IDP via a BFS 
keyboard, and a PASS GPC is currently 
driving the display, dual ОК Bus 
commanders will result, which can cause 
PASS redundant set breakups. 


Always distribute your IDPs among different 
GPCs. On orbit, always be sure to minimize 
SM usage on all IDPs at the same time; if you 
lose SM, you also lose PASS IDP interface. 
The same is true if in single GPC GNC OPS, 
such as in a Group B powerdown. 


When using the GPC MODE switch, always 
take your hand off between positions. On 
past missions, there have been problems with 
the switch being in essentially two positions 
at the same time. This problem can occur on 
other orbiter switches too. It is a good idea 
to always pause slightly in each switch 
detent to ensure the contacts are made and 
recognized by the GPCs. 


The IDP/CRT SEL switch should always be 
checked before making a keyboard entry, 
and data should always be checked on the 
scratch pad line before it is entered. 


е When moding PASS GPCs into the common 


set (ie, STBY to RUN), always pause 10 
seconds before and after switch throws to 
avoid a possible fail-to-sync and to ensure 
proper common set initialization. 
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2.7 DEDICATED DISPLAY SYSTEMS 
CONTENTS 


Description 

Device Driver Unit 

Primary Flight Display (PFD) 
Attitude Director Indicator (ADI) 
Horizontal Situation Indicator (HSI).. 
Flight Instrument Tapes 

PFD Status Indicators 
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Surface Position Indicator (SPI) 
Flight Control System Pushbutton 
Indicators 


Description 


Dedicated displays provide the flight crew with 
information required to fly the vehicle manually 
or to monitor automatic flight control system 
performance. The data on the dedicated dis- 


(ADI) 


Integrated | 
display 


processor 


Orbit PFD 
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plays may be generated by the navigation or 
flight control system software or more directly 
by the navigation sensors. The dedicated 
displays are located in front of the commander's 
and pilot's seats and on the aft flight deck panel 
by the aft-facing windows. 


The dedicated displays are: 


® Primary flight display (РЕР) on the 
MEDS flight instrument display, which 
displays the attitude director indicator 
(ADI) horizontal situation indicator 
(HSI), and Flight Instrument Tapes as 
appropriate to the flight phase 


® Surface position indicator (SPI) on the 
MEDS SPI display 


e Reaction control system activity lights 
on panel F6 


е Head-up display (HUD) on the glare- 
shield in front of the commander's and 
pilot's seats 


Not all the dedicated displays are available in 
every operational sequence or major mode. 
Their availability is related to the requirements 
of each flight phase. 


Keyboard | 


Multifunction Display Unit (MDU) 


А/Е PFD 
(ADI/HSI) SPI 


Translational 
hand 
controller 
(THC) 


controller 
(SBTC) 


Rotational 


Rudder pedal 
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Device Driver Unit 


The device driver unit (DDU) is an electronic 
mechanism that provides dc and ac power for 
the rotational and translational hand controllers 
(RHC and THC), the speedbrake/thrust 
controller (SBTC), and rudder pedal transducer 
assemblies (RPTA). 


The orbiter contains three device driver units: 
one for the commander’s station, one for the 
pilot’s station, and one for the aft station. 


The commander’s DDU is powered from the 
MN A DDU LEFT circuit breaker on panel O14 
and the MN B DDU LEFT circuit breaker on 
panel O15. The pilot’s DDU is powered from 
the MN B DDU RIGHT circuit breaker on panel 
O15 and the MN C DDU RIGHT circuit breaker 
on panel O16. The aft flight station DDU is 
powered from the MN A DDU AFT circuit 
breaker on panel O14 and the MN C DDU AFT 
circuit breaker on panel O16. 


STAR 
TERR ACCEL 
-2 1 


918 


OFF ЕЕ 
Fa L ENG МУ 


MN A DDU Circuit Breakers on Panel 014 
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MN C DDU Circuit Breakers on Panel 016 


Selecting a Flight-Critical Data Bus 


In MEDS, the Integrated Display Processors 
(IDPs) handle all the flight-critical (FC) bus data 
used to drive the flight instrument displays on 
their commanded Multifunction Display Units 
(MDUs). The data bus select menu allows the 
user to select the FC bus (1 - 4) that will be used 
for the flight instrument displays for that MDU. 
MEDS software follows two rules when a data 
bus is selected for an MDU. 


е Each IDP can support up to two 
different FC data bus selections. 


e Each IDP supports only one FC bus 
selection for each crew station (CDR, 
PLT, and aft). 
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If the ЕС data bus selected for ап MDU violates 
one of these rules, other MDUs that are 
displaying flight instrument displays and that 
are being driven by this same IDP will also 
change their FC data bus selection. 


To select a different FC data bus, the user can 
select the DATA BUS option via the edgekeys. 
The MDU retains the current MEDS display, but 
a new submenu appears and allows the user to 
select ЕСТ, 2, 3, or 4 via the edgekey. 


NOTE 


Although all displays indicate a FC 
bus, it is only meaningful on the flight 
instrument displays. Additionally, 
because the FC data buses are assigned 
to specific orbiter GPCs, the selection 
of a FC bus to drive a flight instrument 
display also provides a means of 
assessing the status of individual 
computers that are assigned to ЕСТ, 2, 
3, or 4. See Section 2.6 for detailed data 
bus information. 


Primary Flight Display 


The primary flight display (PFD), also referred 
to as the flight instruments, contains data 
needed for the crew to fly the vehicle and 
maintain control. The PFD displays a 
combination of the attitude director indicator 
(ADI) horizontal situation indicator (HSI), 
various tapes and meters showing vehicle 
parameters, such as angle of attack (о), 
Mach/velocity (M/V), equivalent airspeed 
(KEAS), altitude (H), altitude rate (H dot), 
altitude acceleration (H double dot) and a 
g-meter. The PFD may also have status 
indicators that display the current major mode, 
abort mode, ADI attitude setting, speedbrake, 
throttle, and DAP status. 


The PFD elements will change to show data 
specific each phase of flight, called phase- 
tailoring. During some portions of flight, when 
certain data is not needed, it will be removed 
from the display. That area will either be left 
blank or replaced with data more pertainent to 
that phase of flight. In this section, the PFD 
elements are presented generically, intended to 
give an overall understanding. For more 
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detailed discussion of the PFD during the 
various phases of flight or abort modes, see that 
particular section. 
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Example of Ascent/Entry Primary Flight 
Display in MM103 


Attitude Director Indicator (ADI) 


The ADI gives the crew attitude information as 
well as attitude rates and errors, which can be 
read from the position of the pointers and 
needles. The ADI can be viewed оп the 
Ascent/Entry PFD (A/E PFD), which is a 
composite of various flight instruments 
depending upon flight phase, or on the Orbit 
PFD. 


The commander’s and pilot’s ADIs (supported 
by IDPs 1, 2, and 3) are supported throughout 
the mission; the aft ADI (supported by IDP 4) is 
active only during orbital operations. 


The orbiter’s attitude is displayed to the flight 
crew by a software simulated enclosed ball 
(sometimes called the eight ball) that is 
gimbaled to represent three degrees of freedom. 
The ball, covered with numbers indicating 
angle measurements (an implied 0 is added as 
the last digit of each), moves in response to 
software-generated commands to depict the 
current orbiter attitude in terms of pitch, yaw, 
and roll. 
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The wide band dividing the ball represents 0° 
yaw and is referred to as the belly-band. There 
is also an artifical horizon representing pitch of 
0°, where positive pitch angles (0° to 180°) are 
drawn on the white half of the ball and negative 
pitch angles (180° to 360°) are drawn on the 
darker half of the ball. 


In addition to the graphical attitude 
representation of the ADI ball there is a digital 
readout to the ADI's upper-right showing the 
current roll, pitch, and yaw attitude in degrees. 


Each ADI has a set of switches by which the 
crew can select the mode or scale of the readout. 
The commander's switches are located on panel 
F6, the pilot's on panel F8, and the aft switches 
on panel A6U. 


The ADI ATTITUDE switches determine the 
unit's frame of reference:  INRTL (inertial), 
LVLH (local vertical/local horizontal), and REF 
(reference). Тһе INRTL position allows the 
flight crew to view the orbiter's attitude with 
respect to the inertial reference frame. The 


Rate Indicator 
Rate Scale Label 


Roll Scale 
Attitude Error Needle 


LVLH position shows the orbiter's attitude from 
an orbiter-centered rotating reference frame 
with respect to Earth. The REF position is 
primarily used to see the orbiter's attitude with 
respect to an inertial reference frame defined 
when the flight crew last depressed the ATT 
REF pushbutton above/below the ADI 
ATTITUDE switch. The REF position is useful 
when the crew flies back to a previous attitude 
or monitors an OMS burn for attitude 
excursions. On ascent pre-MECO and on entry, 
with the ADI in LVLH, yaw is not displayed 
and the ADI is pinned to the belly-band in yaw. 


The ADI ATTITUDE switches on panels F6 and 
F8 are active during ascent, orbital, and 
transition flight phases. However, they have no 
effect during entry (MM304, 305, 602, and 603), 
when the ADI attitude is always shown as 
LVLH. Also, when the backup flight system 
(BFS) is engaged, only the commanders 
switches on panel F6 are monitored for 
configuring both commander and pilot ADIs. 
The switch on panel A6U, like the aft ADI, is 
operational only in orbit. 
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Each ADI has a set of three rate pointers that 
provide a continuous readout of vehicle body 
rotational rates. Roll, pitch, and yaw rates are 
displayed on the top, right, and bottom 
pointers, respectively. The center mark on the 
scale next to the pointers represents zero rates. 
The graduated marks on either side of center 
indicate positive or negative rates. The ADI 
RATE switch for each indicator unit determines 
the magnitude of full-scale deflection. HIGH is 
the coarsest setting and LOW is the finest setting. 
Scaling for each switch position is listed in table A, 
ADI Rate Switch vs. Full Range Deflection. On ће 
A/E PFD, the rate pointer scales will be labeled 
according to the selected scale. The rate scales 
are not labeled on the Orbit PFD. These pointers 
are “fly to” in the sense that the RHC must be 
moved in the same direction as the pointer to 
null a rate. 


ADI rate readings are independent of the 
selected attitude reference. During ascent, the 
selected rates come directly from the solid 
rocket booster or orbiter rate gyro assembly 
(RGA) sensors to the ADI processor for display 
via the rate pointers. During entry, only the 
RGA selected pitch rate is directly diplayed as 
the ADI rate. The selected roll and yaw rates 
are first sent to flight control software, where 
they are processed and output to the ADI as 
stability roll and уау rates. (This 
transformation is necessary because, іп 
aerodynamic flight, control is achieved about 
stability axes, which in the cases of roll and yaw 
differ from body axes.) 


In all major modes except TAEM (MM 305 and 
603), the rate pointers strictly display vehicle 
rate information. During TAEM when the ADI 
RATE switch is in MED, the ADI rate pointers 
instead display information on HAC intercept, 
glideslope error, and crosstrack error, which can 
be used to help fly the proper HAC profile. 
During TAEM when the ADI RATE switch is in 
HIGH or LOW, rates will be displayed on a + 5° 
per second scale (see table A). The rate scale 
labels in TAEM will reflect these changes 
accordingly. 
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In addition to the rate pointers, there are three 
magenta-colored needles on each ADI that 
display vehicle attitude errors. These error 
needles extend in front of the ADI ball, with 
roll, pitch, and yaw arranged in the same 
manner as the rate pointers. Similar to the rate 
pointers, each error needle has an arc-shaped 
background scale (also magenta) with 
graduated marks that allow the flight crew to 
read the magnitude of the attitude error. The 
errors are displayed with respect to the body 
axis coordinate system and, thus, are 
independent of the selected reference frame of 
the ADI. 


The ADI error needles are driven by flight 
control outputs that show the difference 
between the required and current vehicle 
attitude. These needles are also “fly to,” 
meaning that the flight crew must maneuver in 
the direction of the needle to null the error. For 
example, if the pitch error needle is deflected 
down, the flight crew must manually pitch down 
to null the pitch attitude error. 


The amount of needle deflection, indicating the 
degree of attitude error, depends upon the 
position of the ADI ERROR switch for each ADI 
and the flight phase. For ascent, orbit, and 
transition phases, in the HIGH position, full-scale 
deflection of the error needles represent 10°, 
MED represents 5°, and LOW represents 1°. For 
entry, the needles signify different errors in 


2. SYSTEMS 
2.7 Dedicated Display Systems 


different phases (see table B). On the A/E PFD 
the error scale is also labeled (in magenta) 
according to ADI ERROR switch position. 


On entry during TAEM (MM 305 and 603), a 
Theta Limits bracket (in green) may be driven 
overlaying the ADI ball. This is a pitch flying 
reference (maximum/minimum pitch attitude) 
when air data transducer assembly (ADTA) data 
is not available to Guidance and Control (G&C) 
below Mach 2. This is described in more detail in 
the TAEM section, 7.4. 


The SENSE switch on panel A6U allows the 
flight crew to use the aft ADI, RHC, and THC in 
a minus X or minus Z control axis sense. These 
two options of the aft ADI and hand controllers 
correspond to the visual data out of the aft 
viewing (negative X) or overhead viewing 
(negative Z) windows. 


Each ADI has a single flag labeled OFF on the 
left side of the display that is used to indicate 
whether valid GPC data is driving the ADI 
software. Presence of the OFF flag can be used 
to determine if a FC bus problem exists at the 
GPC driving the IDP that is hosting the ADI, 
and is used to help troubleshoot in DPS 
malfunction procedures.. There are no flags for 
the rate and error needles; but these indicators 
are blanked when they are invalid. 
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MISSION PHASE ROLL PITCH 


Ascent (101-106, 601) 

Transition/entry (301-304, 602) (deg/s) (deg/s) (deg/s) 
High 10 10 10 
Medium 5 5 5 
Low 1 1 1 

On-orbit (201, 202, 801) (deg/s) (deg/s) (deg/s) 
High 5 5 5 
Medium 1 1 1 
Low 0.2 0.2 0.2 


TAEM to HAC intercept (305, 603) 
High 5 deg/s 5 deg/s 
Time to HAC Altitude error 
intercept (10 sec) (+5000 feet) 

Low 5 deg/s 5 deg/s 
HAC intercept to prefinal (305, 603) 

High 5 deg/s 5 deg/s 
Altitude error HAC X-range 
(+5000 feet) error (-5000 feet) 

Low 5 deg/s 5 deg/s 
Prefinal to 7000 ft (305, 603) 

High 5 deg/s 5 deg/s 
Altitude error HAC X-range 
(+1000 feet) error (+1000 feet) 

Low 5 deg/s 5 deg/s 
7000 ftto landing (305, 603) (deg/s) (deg/s) 

High 

Medium 

Low 


Medium 


Medium 


Medium 


(A) 


MISSION PHASE ROLL | PITCH | YAW 


Ascent/ (101-106, 601) 

On orbit (201, 202, 801) 

Transition (301, 303) (Deg) | (Deg) | (Deg) 
High 10 10 FLT CNTLR 
Medium 5 5 шэн 
Low 1 1 

ENTRY (MM 304, 602*) (Deg) | (Deg) 
High 25 5 2.5 
Medium 2 2.5 
Low 1 2.5 

* о recovery & a transition phases on 


ТАЕМ (ММ 305**, 602*, 603**) (Deg) ШЕ 
High 2.5 
Medium 2.5 
Low . 2.5 

* Nz Hold phase Li s26) (м), 

** WOWLON = 0 M 


ATTITUDE 
WOWLON = 1 INRTL ERROR digg ВАТЕ. 
Rollout (MM 305, 603) (Deg/s) | (Deg) Е 
High 10 2.5 
Medium 5 2.5 2 
Low 1 2.5 


(В) 
ADI Error Switch vs. Full Range Deflection 


PULSE 


1110.cnv 


SENSE Switch on Panel A6U 
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Horizontal Situation Indicator (HSI) 


The HSI displays a pictorial view of the vehicle’s 
position relative to various navigation points and 
shows a visual perspective of certain guidance, 
navigation, and control parameters; e.g. 
direction, distance, апа  course/glidepath 
deviation. The flight crew uses this information 
primarily to control or monitor vehicle 
heading/yaw performance. The HSI is only 
available on the A/E PFD during ascent (MM 102, 
103, 104), return to launch site (MM 601, 602) and 
entry / landing (MM 603, 304, 305) phases. 


The HSI provides an independent software 
source to compare with ascent and entry 
guidance, a means of assessing the health of 
individual navigation aids during entry, and 
information needed by the flight crew to fly 
manual ascent, return to launch site, and entry. 


HSI Ascent Displays 


During nominal ascent (MM 102 and 103, first 
and second stage), the HSI provides information 
about the target insertion orbit. The compass 
card displays heading with respect to target 
insertion plane. The mission-defined target 
insertion plane is defined to be 0° on the compass 
card and the magenta-colored course arrow 
points directly to 0. The compass card headings 
on ascent are also displayed with respect to 


HAC Center Bearing Pointer 


Inertial Bearing Pointer 
Lubber Line 


HAC/Runway Bearing Pointer 
*=HorR 


_ „кы 


Веаппа Нїаа 


Course Deviation Scale 


Course Deviation Indicator 


Fixed Vehicle Reference 


Vrel Bearing Reciprocal 


Inertial Bearing Reciprocal 


HAC Center Bearing Reciprocal 


vehicle orientation. While the orbiter is rolled 
heads-down, the compass card headings increase 
in a counterclockwise direction, and while heads- 
up the compass card is flipped so headings 
increase in a clockwise direction. The heading of 
the body plus X axis (the nose of the orbiter) with 
respect to the target insertion plane is read at the 
lubber line. 


The Earth-relative velocity (Vrel) or “E” bearing 
pointer provides the heading of the Vrel vector 
with respect to the target insertion orbit plane. 
The angular difference between the Vrel and the 
orbiter nose, Beta, is displayed in a digital 
readout box to the upper-left of the HSI. Both 
the “E” pointer and the Beta box are pertinent 
while on the solid rocket boosters (SRBs) and 
through SRB separation. They will be removed 
(blank) after a mission-elapsed time (MET) of 2 
minutes and 30 seconds, or at an altitude of 
200,000 feet. 


The inertial velocity (Vi), or “Т” bearing pointer, 
provides the heading of the Vi vector relative to 
the target insertion plane (course arrow). This 
is also displayed digitally to the right of the HSI 
in the delta-inclination (A Inc) box. 


The course deviation indicator (CDI) deflection 
indicates the lateral offset or crosstrack (in п. 
mi.) between the current orbital plane and the 
targeted orbital plane. The scale for the course 


Delta Azimuth 


or 
HAC Turn Angle 


Vrel Bearing Pointer 
Z A 
1500 Runway Label 
Range to Runway 


HAC-C 


N 
HAC Ctr Label 


Range to HAC Ctr 


Course Arrow 


Course Deviation Flag 


HAC/Runway Bearing Reciprocal 
*=HorR 


Horizontal Situation Indicator 
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deviation updates throughout ascent from 50 to 
10 to 1 n. mi. as the crosstrack decreases. is also 
displayed digitally to the right of the HSI in the 
crosstrack (X-Trk) box. 


HSI Abort Displays 


Тһе HSI for ascent aborts is very similar to 
nominal ascent, with some notable exceptions. 


With an abort to orbit (ATO), the desired target 
inclination may be redefined to equal the 
current inclination, thus the course arrow 
would no longer point directly to 0? on the 
compass card. With the ATO abort, a digital 
box displaying target inclination (Tgt Inc) will 
appear to the right of the HSI, to help indicate if 
the target inclination was redefined. 


With a transoceanic abort landing (TAL), the 
HSI will also display a Runway or “В” bearing 
pointer, which depicts the heading of the TAL 
landing site with respect to the orbiter nose 
(lubber line). Also in the TAL ascent phase, the 
targeted inclination is no longer applicable. 
Thus the A Inc box and the CDI are removed 
and the Crosstrack (X-Trk) box is redefined to 
show the lateral offset in nautical miles (n. mi.) 
of the Vi vector with respect to the Runway 
bearing pointer. Also, the magenta course 
arrow no longer points to the targeted 
inclination, but instead points to the tangency of 
a predetermined crosstrack circle defined about 
the TAL site. A delta crosstrack (A X-Trk) box is 
then shown to the right of the HSI to display the 
lateral offset in nautical miles of the Vi vector 
with respect to the crosstrack circle tangency 
(course arrow). If Vi is already pointing inside 
the crosstrack circle (between the course arrow 
and the runway pointer), then the delta 
crosstrack is defined to be 0 n. mi. 


With a return to launch site (RTLS) abort, the 
HSI will also display a Runway or "R" bearing 
pointer, which depicts the heading of the launch 
site (KSC) with respect to the orbiter nose 
(lubber line). largeted inclination and 
crosstrack are no longer applicable, thus the 
course arrow, the CDI, and the digital boxes for 
AInc and X-Trk are removed. Inertial velocity is 
also no longer applicable, but Earth-relative 
velocity becomes important, so with the RTLS 
abort, the "I" bearing pointer is removed and 
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the “E” bearing pointer and its associated Beta 
read-out return. Also with the RTLS abort, the 
HSI compass card is redefined to represent 
actual magnetic heading with north, east, south, 
west (N, Е, 5, УУ) directions depicted. 


Ascent abort displays for the A/E PFD are 
shown and described in more detail in their 
respective ascent abort sections, 6.3 through 6.5. 


HSI Entry Display Modes 


During entry flight phases (MM304, 305, 602, 
603), the HSI softwares mode and source 
configuration may be controlled by cockpit 
switches. The commander’s HSI switches are 
on panel F6, and the pilot's are on panel F8. 
Ihe HSI SELECT MODE switch selects the 
mode: ENTRY, TAEM, or APPROACH. These 
HSI area navigation software modes are slightly 
different from the guidance phases with 
virtually identical names (Entry, TAEM, and 
Approach and Landing). The ENTRY position 
enables HSI mode auto-switching from Entry to 
TAEM to Approach Ог the TAEM and 
Approach modes can be entered directly by 
respectively taking the HSI SELECT MODE 
switch to ТАЕМ and APPROACH. 


Hs! SELECT 
m BÓ 
TACAN L 


777. 21 | 


ттм 6| (=> !: & 
А ; к=” 


1107.спу 


HSI SELECT Switches on Panel F6 
and Panel F8 


The HSI SELECT SOURCE switch selects 
TACAN, navigation (NAV), or microwave 
landing system (MLS); the 1, 2, 3 switch selects 
one of the three TACAN or MLS units. When 
the HSI SELECT SOURCE switch is positioned 
to NAV, the HSI is supplied with data from the 
navigation processor, and the 1, 2, 3 switch is 
ignored. This makes the HSI display dependent 
on the same sources as the navigation software 
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(IMU, selected air data, selected navigational 
aids), but it is independent of guidance 
targeting parameters. 


When the HSI SELECT SOURCE switch is in 
TACAN or MLS, the HSI area navigation 
software is supplied with data derived from the 
unit specified by the 1, 2, 3 switch. The TACAN 
and MLS positions should only be used when 
TACAN or MLS data are available. TACAN 
data is used during entry to update the 
navigation state, and is usually acquired about 
300 nm. from the landing site. MLS has a range 
of 20 nm. and would be normally be selected 
after the orbiter is on the HAC. 


HSI Entry Display Parameters 


Depending on phase of entry, each HSI displays 
magnetic heading (compass card), selected 
course, runway magnetic heading, course 
deviation, glideslope deviation, runway and 
HAC tangency/center bearing, runway and 
HAC center range, as well as bearing and 
course deviation indicator (CDI) flags 10 
indicate validity. 


Each HSI consists of a compass card measuring 
0° to 360°. Fixed at the center of the card is an 
aircraft symbol about which the compass card 
rotates. 


The magnetic heading (the angle between 
magnetic north and vehicle direction measured 
clockwise from magnetic north) is displayed by 
the compass card and read under the lubber 
line located at the top of the indicator dial. (A 
lubber line is a fixed line on a compass aligned 
to the longitudinal axis of the craft.) The 
compass card is positioned at N (north) when 
the heading input is zero degrees. As the 
heading point is increased, the compass card 
rotates counterclockwise beneath the fixed 
lubber line if flying in a heads-up attitude. 


In the Entry mode (MM 304 and 602), the 
compass card heading indicates the magnetic 
heading of the vehicle’s relative velocity vector 
(Vrel). When the HSI is in the TAEM and 
Approach modes during MM 305 and 603, the 
compass card indicates magnetic heading of the 
body X axis. 
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Magnetic 
north 


Vehicle 
direction 


Magnetic 
heading 


276.cvs 
HSI Heading Geometry 


The magenta-colored course arrow is used in 
glided flight (MM 304 & 305 or 602 & 603) to 
indicate the selected runway heading with 
respect to true north. As the compass card 
rotates, the course arrow will rotate with the 
card. This provides a continuous reference to 
the selected runway. 


On entry, the HSI course deviation indicator 
(CDI) shows course deviation as an angular 
measurement of vehicle displacement from the 
extended runway centerline. The CDI 
represents course deviation by the deflection of 
the deviation bar from the course pointer line. 
When the HSI is in the Entry mode (MM 304 
and 602), the CDI is inactive and pegged at zero 
and the scale is not labeled. When the HSI is in 
the TAEM mode, full-scale deflection on the 
CDI is +10° as reflected by the scale label. 
When the HSI is in the Approach mode, full- 
scale deflection is decreased to +2.5°. The CDI 
is a “fly to” indicator for flying the vehicle to 
the extended runway centerline. When the 
course deviation is zero, the deviation bar is 
aligned with the end of the course pointer. 
With the pointer in the top half of the compass 
card, an increase in course deviation to the left 
(right) causes the bar to deflect to the right (left). 
Software processing also ensures that the CDI 
remains “fly to”, even when the orbiter is 
heading away from the runway. 
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In course deviation geometry, if the orbiter is to 
the left of the runway, it must fly right (or if the 
orbiter is to the right of the runway, it must fly 
left) to reach the extended runway centerline. 
The corresponding course deviation bar would 
deflect to the right (or to the left) accordingly. 
The sense of the CDI deflection is a function of 
vehicle position rather than vehicle heading. 
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Reference Point 


Runway 


a, b: 

Course Deviation 
Angles Corresponding 
to Points A and B 


A, B: 


| 
| 
| 
| 
| Orbiter Positions 
| 

| 


А В 
Extended Centerline 277.суе 
Course Deviation Geometry 
HSI mode Bearing Range Course Glide slope Compass 
[ ] indicates bearing П indicates range label deviation deviation (GSI) card 
pointer label (СОТ) (heading) 
Entry [H] Spherical bearing to | [selected rwy] Spherical | Pegged at zero Blanked Magnetic 
NEP HAC intercept surface range to runway (no CDI flag) heading of 
touchdown point via NEP vehicle 
velocity 
vector (flight 
path) 
TAEM ІНІ Bearing to NEP HAC | [selected rwy] Range to fly | Deviation from Error from Magnetic 
intercept to runway touchdown runway guidance heading of X 
point, via the HAC, for | centerline (full TAEM body axis 
selected EP (NEP or МЕР) scale £10?) reference 
[C] Bearing to HAC [HAC-C] Horizontal 42 
center distance to the HAC +2500 ft) 
center 
Approach [R] Bearing to runway | [selected rwy] Horizontal | Deviation from Error from Magnetic 
touchdown point distance to runway touch- runway guidance A/L | heading of X 
down point centerline (full reference body axis 
scale +2.5°) altitude (full 
scale +1000 ft). 
Not computed 
below 1500 ft 
(GS flag 
displayed) 
HSI Function Matrix 
With the HSI in the TAEM and Approach the desired slope deflects the pointer 


modes (MM 305 and 603), glideslope deviation, 
the distance of the vehicle above or below the 
desired glideslope, is indicated by the deflection 
of the glide slope indicator (GSI) pointer 
displayed to the right of the HSI. The GSI 
display is blank when the HSI is in the Entry 
mode. The pointer is a “fly to” indicator, so an 
increase in glideslope deviation above (below) 


2.7-11 


downward (upward). 


The “desired glideslope" is actually only a 
conceptual term in HSI processing. At any 
instance, the HSI GSI deviation is really the 
difference between the current orbiter altitude 
and a reference altitude computed by Area Nav. 
This reference altitude may be slightly different 
than the reference altitude computed by 
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guidance. Also included in the reference 
altitude equation are factors for a “heavy 
orbiter” and for high winds. 


3051/050/ HORIZ SIT 2 008/04:12:54 
PTI INH 1 ALTIM 000/00:29:12 
INDEX 0 9 29.92 ү дә y NAV DELTA 
mij + 
"aris AX 10 
11 0 
41 LAND SITE 1 Time-to-HAC- AY 11 
5 * : А 5.0K -- 
PRI КОСТУ Ч о intercept predictor Ll " 
БЕС KSC33 4 АР 12 
ТАС- 159 5 + 11 о 
GPS КОМ ВА o AX 13 
ue 46 0+ [] 0 
ТАЕМ TGT Glide slope __-> k= ay 14 
G&N L OVHD 6 error | 1 о 
HSE L А215 
НЕР 7 11-90 
5.0K + 
AIM NOM 8 2 i LOAD 16 
В NOM 18 AT [ 10.00 
МАУ [RESID | RATIO| AUT | ТЫН | FOR] ТАС1- 59 | ТАС2- 59| TAC3- 59 
ТАС Ag+ 0.57 0.1 | 95|20 |21 |+ 0.37 |+ 0.37 |+ 0.31 
RNd* 0.02 0.0 - 0.00 |+ 0.00 |+ 0.00 
GPS |+ 0.16 | vo.4 | 42 | 43* | 44 DES 31 DES 32 DES 33 
DRAG H 22% |23 |24 | ABS 34 DELTA 35* 
АРТА H* 461 0.1 | 25* | 26 |27 |бР5 RN 0.0 А+ 2.86 
АРТА ТО GNC 285129 |30 |AIF_G 47 48* 49 H 47.0 


HORIZ SIT Display (SPEC 50) 


The HORIZ SIT display (SPEC 50) allows the 
flight crew to configure the software for 
nominal winds or high head winds. The item 7 
entry toggles to select the nominal entry point 
(NEP) or minimum entry point (MEP), which 
determines the distance from the runway 
threshold to the intersection of the glideslope 
with the runway centerline or aim point. The 
item 8 entry toggles from the nominal (NOM) 
aim point to the close-in (CLSE) or high-wind 
aim point, which pushes the intercept point 
closer to the runway threshold. The distance 
selected is factored into the computation of HSI 
reference altitude from which the glideslope 
deviation is derived. 


The GSI in TAEM indicates deviations from the 
guidance reference altitude +5,000 feet. The GSI 
during approach апа landing indicates 
guidance reference altitude +1,000 feet. 


The HSI GSI computation is not processed 
below 1,500 feet during the Approach mode; so 
the glideslope indicator flag (GS) is displayed. 


In glided flight, the HSI also displays bearing 
pointers relative to the compass card. The HAC 
bearing pointer, labeled “Н”, indicates spherical 
bearing to HAC tangency point (Way Point 1) 
when in the Entry and TAEM modes (MM 304, 
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305 and 602, 603). The HAC Center bearing 
pointer, labeled "C", indicates bearing to the 
HAC center when in the TAEM mode (MM 305 
and 603). When the HSI is in the Approach 
mode, the “Н” bearing pointer is redefined to 
indicate the bearing to the touchdown point at the 
primary runway (way point 2). 


When the bearing inputs are zero, the pointers 
are at the top lubber line, regardless of compass 
card position. The bearing pointer commands 
are developed by subtracting the vehicle 
heading from the calculated bearing values. 
When the bearing inputs are increased, the 
pointers rotate clockwise about the compass 
card. The pointer does not reverse when it 
passes through 360? in either direction. In other 
words, each bearing pointer has a reciprocal 
“tail” of the pointer 180° out. 


x Runway 


Magnetic 
north 


Bearing 
angle 


Reference 
“гот 


278.су5 


Horizontal Situation Indicator Bearing and 
Range Geometry 


The HSI also displays range values immediately 
to the right of the compass card. With TAL, 
RTLS, or East Coast Abort Landing (ECAL) and 
entry phases, the selected runway is displayed 
immediately above a box with a digital readout 
of range to the runway in nautical miles (nm). 
On entry this range includes the curvilinear 
geometry for a path to the HAC tangency, 
around the HAC and to the runway threshold. 
In the TAEM mode, a range box for HAC center 
(HAC-C) will also appear, showing the straight- 
line range from the vehcile to the center of the 
HAC in nautical miles. 
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HSI Flight Path Geometry-Top View 
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The HSI has three OFF flags -- ВКС (bearing), 
GS (glideslope), and CDI -- identifying invalid 


data. BRG indicates invalid course and/or 
bearing data. GS indicates invalid glideslope 
deviation. CDI indicates invalid course 


deviation data. 


Also during entry and the acquisition phase of 
TAEM, the current AAz (delta azimuth) is 
displayed to the upper-right of the HSI. AAz is 
the angular difference between the heading to 
the HAC tangency point and the heading of the 
relative velocity vector (entry) or the vehicle 
heading (TAEM). When the guidance enters the 
HAC phase during TAEM, the AAz field is 
blanked. 


Flight Instrument Tapes 


The flight instrument tapes consist of several 
meters and/or digital displays indicating angle 
of attack (a), vehicle Mach or velocity (M/V), 
knots equivalent airspeed (KEAS), altitude (H), 
altitude rate (H dot), altitude acceleration (H 
double dot), and a g-meter (Accel/Nz). For each of 
the tapes, with the exception of altitude 
acceleration, the value is read by a digital 
window centered on the moving tape. The flight 
instrument tapes are only available on the 
ascent/entry primary flight display (A/E PFD). 


Some documentation refer to the tapes as the 
alpha/Mach indicator (AMI) апа the 
altitude/vertical velocity indicator (АУУР, 
refering to the old cockpit configuration when 
the tapes were displayed in a separate format. 
The AMI consisted of the angle of attack, velocity 
and airspeed tapes. The AVVI consisted of the 
altitude, altitude rate, and altitude acceleration 
tapes. 


The a tape displays vehicle angle of attack, 
defined as the angle between the vehicle plus X 
axis and the wind-relative velocity vector 
(negative wind vector). Alpha is shown in a 
scrolling window with а fixed pointer 
indicating the current angle of attack in 1° 
increments. The digital decimal value is 
provided as part of the pointer using white 
numbers on a black background. Positive alpha 
values are black numbers on a_ white 
background, and negative values are white 
numbers on a black background. The о tape 
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ranges from -180° to +180°. Below Mach 3.0, a 
magenta diamond indicates the optimum alpha 
for maximum lift-over-drag (max L/D). On 
entry (MM 304, 305, 602, and 603), except for 
contingency aborts, a green bar on the a tape 
depicts the range of allowable 
maximum/ minimum alphas. 


Current orbiter 
position 

Current 
velocity 


283.cvs 


Angle of Attack 


On ascent and on entry above Mach 0.9, the M/V 
tape displays Mach number, relative velocity 
(Vrel), or inertial velocity (Vi). Mach number is 
the ratio of vehicle airspeed to the speed of 
sound in the same medium. The Vrel is in feet 
per second in relation to the Earth. Vi is in feet 
per second and does not consider the rotational 
speed of the surface. The actual parameter 
displayed is always Mach number; the tape is 
simply rescaled above Mach 4 to read Vrel (MM 
102, 304, 305, 602 and 603 with the tape labeled 
M/VR) or Vi (MM 103 and 601 with the tape 
labeled M/VI). The scale ranges from 0 to 27.0K 
feet per second, with a scale change at Mach 4 
(4.0M). Located below the tape is a digital 
readout box displaying knots equivalent 
airspeed (KEAS). 


Below Mach 0.9 on entry, the M/VR tape swaps 
with the KEAS digital box. The KEAS tape 
range is zero to 500 knots, and scaling is 1 inch 
per 10 knots. The digital readout box will then 
read Mach number. 
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Entry PFD below Mach 0.9 


The g-meter is a circular meter in the lower-left 
corner of the A/E PFD which displays vehicle 
acceleration from -1g up to 4g on ascent during 
powered flight (MM 102, 103, and 601) and entry 
(MM 304, 305, 602 and 603). The value is displayed 
via a green arrow on the meter and a digital 
readout box. In powered flight, the meter reflects 
the IMU-derived vehicle acceleration and is 
labeled “Accel”. During glided flight, the meter 
displays the selected accelerometer assembly 
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(AA) normal acceleration (Nz) value and 15 
labeled “Nz”. A magenta Target Nz line is 
provided during MM 602 showing the Target 
Nz value calculated on RTLS and contingency 
aborts in glided flight. 


The H (altitude) tape displays the altitude of the 
vehicle above the runway (nav-derived or 
barometric altitude). The scale range is -1,100 
feet to +165 n.mi., with scale changes at -100, 0, 
200, 2000, 30K, 100K and 400K feet. The scale is 
in feet from -1,100 to 400K and in n.mi. from 
+65 nm to +165 n.mi. 


The altitude tape has black number and 
markings on a white background for altitudes 
above 2,000 feet. The tape background color is 
yellow for altitudes below 2,000 feet. 


When the radar altimeter (RA) sensor selected 
by the commander (pilot) is locked on, an “К” 
appears to the right of the altitude digital, and 
the digital is driven by the RA data on the 
commander’s (pilot’s) PFD. A floating yellow 
triangle also appears to the right of the tape at 
the value of the RA altitude. If no RA is locked 
on, a “K,” indicating thousands of feet, or an 
“М/ indicating nautical miles will appear to the 
right of the altitude tape digital indicating the 
units. 


The H tape displays vehicle altitude rate. The 
scale range is -2,940 to +2,940 feet per second 
with scale changes at -740 feet per second and 
+740 feet per second. The negative and positive 
regions are color-reversed: negative numbers 
are white on a gray background and positive 
numbers are black on white. 


The H tape is dislayed in the lower-right corner 
of the PFD on entry during MM 304 and 602 
and indicates altitude acceleration of the 
vehicle. A triangular pointer moves along the 
fixed scale. The scale range is -10 to +10 ft/sec’, 
where the negative side is grey and the positive 
side is white. Software limits acceleration 
values to +12.75 ft/sec?. 


Ihe RDR ALT indicator is controlled by the 
RADAR ALTM switch on panel F6 for the 
commander and panel F8 for the pilot. RADAR 
ALTM positioned to 1 selects radar altimeter 1; 
2 selects radar altimeter 2. 
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on Panel F6 
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Pilot's RADAR ALTM Switch on Panel ЕЗ 


With the AIR DATA source switch in the NAV 
position, the H, H Р Н tapes аге navigation- 
derived. The AIR DATA switch is positioned to 
LEFT or RIGHT to select the left or right air data 
probe after air data probe deployment at Mach 
5. With the switch in LEFT or RIGHT, the H, 
H , tapes receive information from the selected 
air data probe, but the H tape still receives 
navigation data. 


The AIR DATA switch on panel F6 for the 
commander and panel F8 for the pilot also 
determines the source of data for the о, M/V, and 
KEAS tapes and/or digital readouts When in the 
NAV position, the same parameters (alpha, Mach 
and airspeed) that are sent to guidance, flight 
control, navigation, and other software users are 
displayed. 


With the switch in LEFT or RIGHT the left or right 
air data probe assembly data is processed and 
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displayed. The probes are not deployed until 
below Mach 5, however, the data will not be 
accurate until the velocity is less than Mach 3.5, 
due to calibration of the probes. 
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Commander's AIR DATA Switch on Panel F6 
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Pilot's AIR DATA Switch on Panel F8 


PFD Status Indicators 


Unlike the Orbit PFD, the A/E PFD has four 
status fields, two each in the upper left and 
right corners, which display the major mode, 
abort mode, DAP, ADI attitude switch position, 
and 5ВТС status. These status indicators will 
change, depending upon the phase of flight, to 
show appropriate data. 


Ihe top right status indicator field always 
displays the major mode. If an abort has been 
declared, an indicator will be displayed 
immediately to right of the major mode (R for 
RILS, T for TAL, CA for contingency aborts, 
AOA, or ATO). 


During powered flight (MM 102, 103 and 601), 
the left side fields display the DAP mode 
(AUTO or CSS) and the throttle mode (AUTO or 
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МАМ). If either CSS ог MAN are selected, a 
yellow box will outline the field to indicate an 
off-nominal configuration. Рові-МЕСО (MM 
104-106), the DAP mode indicates either AUTO 
or INRTL, while the throttle field will blank. 


Also the bottom right status displays the ADI 
attitude switch, either Inrtl, LVLH, or. Ref 
during ascent and post-MECO. 


DAP: AUTO 
ТНКОТ: AUTO 


MM: 102 
ATT: LVLH 


usa007587 10024r1.tif 
Example of PFD Status Indicators in MM 102 


During entry transition (MM301-303), the status 
fields display the same functions as post- 
MECO. 


During entry (MM304, 305, 602, and 603), the 
left side fields display both the DAP pitch and 
roll/yaw modes (AUTO or CSS). The bottom 
right field displays the speedbrake mode 
(AUTO or MAN). If either MAN speedbrake is 
selected, or if CSS is selected above Mach 1.0, a 
yellow rectangle is drawn around the indicator. 


MM: 304 
SB: AUTO 


Pitch: AUTO 
R/Y: AUTO 
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Example of PFD Status Indicators in MM304 


Surface Position Indicator (SPI) 


The SPI is a MEDS display that is active during 
entry (MM 304, 305, 602 and 603) and displays 
the actual positions of the elevons, body flap, 
rudder, aileron, and speedbrake, as well as the 
commanded speedbrake position. 


The IDPs get data from analog-to-digital 
converters (ADCs) 1A and 1B for display on the 
SPI (see Section 2.6 for more information on 
IDPs and ADCs). For ADC failures or invalid 
data cases, the SPI bars will be outlined in red 
and the triangles will disappear. 


ELEVONS BODY FLAP 
DEG % 
Г Е 


RUDDER-DEG 
30 20 10 О 10 20 30 
poe qup A ppp nip 


L RUD R RUD 


AILERON-DEG 


5 5 
„а ја Ја му ја ја ја Та 1: 


L AIL RAIL 


SPEEDBRAKE 96 


ACTUAL 

20 40 60 80 100 
в 1 LA 

Шин шин Т Т v 


COMMAND 080 


289.CNV 
Surface Position Indicator 


The four elevon position indicators show the 
elevon positions in the order of appearance as 
viewed from behind the vehicle (left outboard, 
left inboard, right inboard, right outboard). The 
scales all range from +20° to -35?, which are 
near the software limits for the elevon 
commands. The pointers are driven by four 
separate signals and can read different values, but 
normally the left pair is identical and the right 
pair is identical. Positive elevon is below the null 
line (elevon deflected down) and negative is 
above (elevon deflected up). 
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SPI Elevon Travel 
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The body flap scale reads body flap positions 
from zero to 100 percent of software-allowed 
travel. Zero percent corresponds to full up 
(-11.7°) and 100 percent corresponds to full 
down (+22.5°). The small pointer at 34 percent 
is fixed and shows the trail position. 


Rudder position is displayed as if viewed from 
the rear of the vehicle. Deflection to the left of 
center represents left rudder. The scale is +30° 
(left) to -30° (right), but software limits the 
rudder command to +27.1°. 


RUDDER-DEG 


30 20 10 0 10 20 Ээ? ж 
Lit. I LA E x qa 
LRUD R RUD ; 


-27.19 
(right) 


0 


+27.1° 
(left) 
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SPI Rudder Travel 


The aileron display measures the effective 
aileron function of the elevons in combination. 
Aileron position equals the difference between 
the average of the left and right elevon divided 
by two. Deflection of the pointer to the right of 
center indicates a roll-right configuration (left 
elevons down, right elevons up) and vice versa. 
The scale is -5° to +5°, with -5° at the left side. 
The aileron command can exceed +5° (max. 
+10°), in which case the meter saturates at +5°. 
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SPI Aileron Travel 


The speed brake position indicator indicates the 
actual position on the upper scale and 
commanded position on the lower scale. The 
position ranges from zero to 100 percent; zero 
percent is fully closed, and 100 percent is fully 
open, which corresponds to 98 percent with 
respect to the hinge lines. 


The speed brake command is scaled identically to 
position and has the same travel limits. It always 
represents the 
command. 
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SPI Top View of Open Speed Brake 
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Flight Control System Pushbutton 
Indicators 


The flight control system's pushbutton 
indicators transmit flight crew moding requests 
to the digital autopilot (DAP) in the flight 
control software and reflect selection Бу 
illuminating the effective DAP state. These 
indicators are located on panel F2 for the 
commander and panel F4 for the pilot. 


The pushbutton indicators are used to command 
and reflect the status of the pitch and roll/yaw 
control modes. The PITCH and ROLL/YAW 
indicator pushbuttons transmit moding requests 
to the DAP as well as light up to indicate the 
effective state of the pitch and roll/yaw DAP 
channels. 


AUTO indicates that control of that axis (pitch 
or roll/yaw) is automatic, and no crew inputs 
are required. CSS is control stick steering; crew 
inputs are required, but are smoothed by the 
DAP (stability augmentation, turn 
coordination). 


The SPD BK/THROT (speed brake/throttle) 
pushbutton indicator is a single pushbutton 
with two separate lights, AUTO and MAN, to 
indicate that the DAP speed brake channel is in 
the automatic or manual mode. When 
depressed, the pushbutton only transmits the 
AUTO request. The MAN indicator will only 
light up for which ever position, commander or 
pilot has taken manual control with the 
speedbrake/ thrust controller (SBTC). Only one 
position at a time, commander or pilot, can have 
MAN selected. 


The BODY FLAP pushbutton indicator is also one 
pushbutton with separate AUTO and MAN lights, 
indicating the state of the body flap channel. 


2.7-19 


USA007587 
Rev. A 


Reaction Control System Command Lights 


The RCS COMMAND lights on panel F6 are 
active post-MECO during MM 104-106, OPS 2, 8, 
3, and MM 602-603. Their primary function is to 
indicate reaction control system (RCS) jet 
commands by axis and direction during 
transitional and orbit phases. Their secondary 
function on entry is to indicate when more than 
two yaw jets are commanded and when the 
elevon drive rate is saturated. 


On entry, MM304, until the roll jets are no 
longer commanded (dynamic pressure exceeds 
10 pounds per square foot), the ROLL L and R 
lights indicate that left or right roll jet 
commands have been issued by the DAP. The 
minimum light-on duration is extended so that 
the light can be seen even during minimum- 
impulse firings. On entry (MM304 and 602), 
when dynamic pressure is greater than or equal 
to 10 pounds per square foot, the ROLL lights 
are quiescent until 50 pounds per square foot, 
after which time both lights (L and R) are 
illuminated whenever more than two yaw jets 
are commanded on. 


On entry, OPS 3 and 6, the PITCH U and D 
lights indicate up and down pitch jet commands 
until dynamic pressure equals 40 pounds per 
square foot, after which the pitch jets are no 
longer used. When dynamic pressure is 50 
pounds per square foot or more, the PITCH 
lights, like the ROLL lights, assume a new 
function. Both light (U and D) whenever the 
elevon surface drive rate exceeds 20° per second 
(14° per second if only one hydraulic system is 
working). 


On entry, the YAW L and R lights function as 
yaw jet command indicators throughout entry 
until the yaw jets are disabled at Mach 1. The 
yaw lights have no other functions. 
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Entry Flight Control System Mode Pushbutton Indicator Light Logic 


LIGHTS LEFT/RIGHT LIGHT LOGIC CAUSES 


PITCH AUTO Both on or both “| Auto, С55 | PITCH AUTO pushbutton indicator depressed 


mutuall 
12: PITCH CSS pushbutton indicator depressed or RHC out of detent іп pitch 


PITCH CSS both on or both off 


ROLL/YAW AUTO Both on or both “| Auto, CSS | ROLL/YAW AUTO pushbutton indicator depressed 


mutually 


ROLL/YAW CSS both on or both off ] exclusive ROLL/YAW CSS pushbutton indicator depressed or RHC out of detent in roll or yaw 


SPD BK/THROT 


mutually 


AUTO Both on or both m Auto, man. | Neither SBTC takeover pushbutton depressed or AUTO pushbutton depressed 
exclusive 


MAN One on, one off Either SBTC takeover pushbutton depressed 


BODY FLAP 


mutually 


AUTO Both on or both p Auto, man. | AUTO pushbutton indicator depressed 
exclusive 


MAN Both on or both off MAN pushbutton depressed 
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RCS COMMAND Lights on Panel F6 
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Head-Up Display (HUD) 


The HUD is an optical miniprocessor that cues 
the commander and/or pilot during the final 
phase of entry and particularly in the final 
approach to the runway. With minimal 
movement of their eyes from the forward 
windows (head up) to the dedicated display 
instruments (head down), the commander and 
pilot can read data from head-up displays 
located in the front of them on their respective 
glareshields. The HUD presents the same data 
that is presented on several other instruments, 
including the PFD and the SPI. 


The HUD allows out-of-the-window viewing by 
superimposing flight — commands апа 
information on a transparent combiner in the 
window’s field of view. Since the orbiter 
avionics systems are digital, and minimal 
impact on the orbiter was paramount, the head- 
up display drive electronics were designed to 
receive data from the orbiter data buses. The 
HUD electronics utilize, to the maximum extent 
possible, the same data that drive the existing 
electromechanical display devices. The orbiter 
display device uses a CRT to create the image, 
which is then projected through a series of lenses 
onto a combining glass. 


Each HUD is a single-string system, but it is 
connected to two data buses for redundancy. It 
is an electronic/optical device with two sets of 
combiner glasses located above the glareshield 
in the direct line of sight of the commander and 
the pilot. Essential flight information for 
vehicle guidance and control during approach 
and landing is projected on the combiner 
glasses and focused at infinity. 
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The images, generated by a small CRT and 
passed through a series of lenses, are displayed 
to the flight crew on the combiners as lighted 
symbology. The transmissiveness of the 
combiner allows the crew to look through it and 
see actual targets like the runway. 


For instance, if the crew is 9,000 feet on the final 
approach course in a solid overcast, the base of 
which is at 8,000 feet, the lighted outline of the 
runway would be displayed on the combiner. 
However, when the orbiter exits the overcast at 
8,000 feet, the lighted outline of the runway 
would be superimposed on the real runway. As 
the orbiter proceeds down the steep glideslope, 
the velocity vector is superimposed over the 
glideslope aim point. At preflare altitude, flare 
triangles move up to command the pullout. The 
pilot maintains the velocity vector symbol 
between the triangles. After a short period of 
stabilized flight on the shallow glideslope, the 
guidance diamond commands a pitch-up until 
the nose is about 8° above the horizon, which is 
essentially the touchdown attitude. After 
touchdown, during the rollout phase, the crew 
maintains the approximate touchdown attitude, 
+6° theta (nose above the horizon), until 185 
knots equivalent airspeed and then commands 
a derotation maneuver. 


The HUD has proved to be a valuable landing 
aid and is considered the primary pilot display 
during this critical flight phase. 


A HUD POWER ON/OFF switch located on the 
left side of panel F3 provides and terminates 
electrical power to the commander's head-up 
display on panel F6. A second switch is located 
on the right side of panel ЕЗ for the pilot’s head- 
up display on panel F8. 


Panel F3 
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WARNING 


A generic hardware problem has been 
identified in several HUD units. At 13 
KFT, the flight director symbol is uncaged 
to become a velocity vector (©). Cycling 
HUD POWER after this transition may 
result in erroneous symbol positioning. 
Flying these false cues would result in 
landing short of the runway, at a very high 
sink rate. (Ref: JSC Memo DF6-90-053) 
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Head-Up Display and Controls on Panel F6 
(Identical on Panel Е8) 
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A three-position MODE switch is located below 
the HUD. In the NORM position, automatic 
sequencing of formats and symbology is 
provided. The TEST position forces up a test 
display for 5 seconds. Selection of the 
momentary DCLT (declutter) position initiates a 
symbol blanking routine. Successive selections 
of DCLT will serially remove display elements 
in the following order. The first activation 
removes the runway symbology. The second 
activation removes the airspeed and altitude 
tapes (replacing them with digital values) and 
the horizon/pitch attitude scales, but leaves the 
horizon line when within FOV. The third 
declutter level removes all symbology except 
for the boresight. A fourth declutter attempt 
will return the HUD to its original form with all 
symbols displayed. 


Data displayed on the HUD comes from the 
GPCs across flight critical (FC) databus 1 or 2 
for the CDR’s HUD and FC databus 3 or 4 for 
the PLT’s HUD. A HUD databus switch on 
panel F6 (CDR) ог F8 (PLT) controls the data 
source. 
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Note: Horizon is displayed when 
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Approach and Land Display (Declutter Level 2) 
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Approach and Land Display (Declutter Level 3) 
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Dedicated Display Systems Summary 
Data 


Dedicated displays are located on the flight 
instrument and subsystem status displays 
driven on the 11 multifunction display units 
(MDU) ша MEDS cockpit. 


Dedicated displays include: the primary 
flight displays (PFDs), SPI, RCS activity 
lights, and HUDs. 


Circuit breakers for device driver units are 
located on panels O14, O15, and O16. 


The attitude director indicator (ADI) displays 
orbiter attitude by a simulated ball gimbaled 
to represent three degrees of freedom. 


The PFD will alter appearance based upon 
phase of flight and abort mode. 


The horizontal situation indicator 
displays ^ certain 


(HSI) 
guidance, 


visually 
navigation, and control parameters such as 
directions, distances, and course/glide path 
deviation. 


The Ascent/Entry PFD (A/E PFD) displays 
flight instruments, which include angle of 
attack, vehicle velocity, knots equivalent 
airspeed, acceleration, altitude, radar 
altitude. vertical velocity, апа vertical 
acceleration on a flight phase-tailored basis 
for ascent, aborts, and entry. 
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The A/E PFD has a status indicator field 
across the top for major mode, abort, and 
DAP status. 


The orbit PFD is simply an ADI with no 
status indicators across the top. 


The SPI displays actual positions of the 
elevons, body flap, rudder, aileron, and 
speedbrake. Speedbrake commanded 
position is also displayed. 


The HUD cues the commander and/or pilot 
during final phases of entry Бу 
superimposing flight commands апа 
information on a transparent combiner in the 
window’s field of view. Power switches are 
located on panel F3. 


On orbit, when in the Flight Control System 
(FCS) checkout mode (MM 801), all displays 
can be driven by test software to allow the 
crew to verify correct operation prior to 
entry. 
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Panel F6 
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28 ELECTRICAL POWER SYSTEM 
(EPS) 


CONTENTS 


Description 

Power Reactants Storage and 
Distribution System 

Fuel Cell System 

Electrical Power Distribution and 


Operations 

EPS Caution and Warning Summary 
EPS Summary Data 

EPS Rules of Thumb 


Description 


The electrical power system (EPS) consists of the 
equipment and reactants that produce electrical 
power for distribution throughout the orbiter 
vehicle, and fulfill all the orbiter external tank, 
solid rocket booster, and payload power 
requirements, when not connected to ground 
support equipment. The EPS operates during all 
phases of flight. For nominal operations, very 
little flight crew interaction is required by the 
EPS. 


The EPS is functionally divided into three 
subsystems: power reactants storage and distri- 
bution (PRSD), three fuel cell (FC) power plants, 
and electrical power distribution and control 
(ЕРРО). 


Through a chemical reaction, the three FCs 
generate all 28-volt direct-current electrical 
power for the vehicle from launch minus 50 
seconds through landing rollout. Prior to that, 
electrical power is provided by ground power 
supplies and the onboard FCs. 
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Power is controlled and distributed by 
assemblies located in the forward, mid, and aft 
sections of the orbiter. Each assembly is a 
housing for electrical components such as remote 
switching devices, buses, resistors, diodes, and 
fuses. Each assembly usually contains a power 
bus or buses and remote switching devices for 
distributing bus power to subsystems located in 
its area. 


Power Reactants Storage and Distribution 
System 


The PRSD system stores the reactants (cryogenic 
hydrogen and oxygen) and supplies them to the 
three FCs that generate all the electrical power for 
the vehicle during all mission phases. In 
addition, the subsystem supplies cryogenic 
oxygen to the environmental control and life 
support system (ECLSS) for crew cabin 
pressurization. The hydrogen and oxygen are 
stored in tanks at cryogenic temperatures (-285?F 
for liquid oxygen and -420? F for liquid 
hydrogen) and supercritical pressures (above 731 
psia for oxygen and above 188 psia for 
hydrogen). 


The PRSD system components are located in the 
orbiter midbody underneath the payload bay 
liner. The system stores the cryogenic hydrogen 
and oxygen in  double-walled, thermally 
insulated spherical tanks with a vacuum annulus 
between the inner pressure vessel and outer tank 
shell. Each tank has heaters to add energy to the 
reactants during depletion to control pressure. 
Each tank has sensors that measure temperature, 
pressure, and quantity. 


The tanks are grouped in sets of one hydrogen 
and one oxygen tank. The number of tank sets 
installed depends on the specific mission 
requirement and vehicle. Up to five tank sets can 
be installed in the midfuselage under the payload 
bay liner. 
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The PRSD System 


Cryogenic Storage Tanks 


All oxygen tanks are identical and consist of 
inner pressure vessels of Inconel 718 and outer 
shells of aluminum 2219. The inner vessel is 
33.435 inches in diameter and the outer shell is 
36.8 inches in diameter. Each tank has a volume 
of 11.2 cubic feet and stores up to 781 pounds of 
oxygen. The dry weight of each tank is 215 
pounds. Maximum fill time is 45 minutes. 


АП hydrogen tanks are also identical. Both the 
inner pressure vessel and the outer shell are 
constructed of aluminum 2219. The inner 
vessel’s diameter is 41.51 inches and the outer 
shell's is 45.5 inches. The volume of each tank is 
21.39 cubic feet, and each stores up to 92 pounds 
of hydrogen. Each tank weighs 227 pounds dry. 
Maximum fill time is 45 minutes. 


The inner pressure vessels are kept supercold by 
minimizing conductive, convective, and radiant 
heat transfer. Twelve low-conductive supports 
suspend the inner vessel within the outer shell. 
Radiant heat transfer is reduced by a shield 
between the inner vessel and outer shell 
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(hydrogen tanks only), and convective heat 
transfer is minimized by maintaining a vacuum 
between the vessel and shell. During ground 
operations, a vacuum ion pump maintains the 
required vacuum level and is also used as a 
vacuum gauge to determine the vacuum’s 
integrity. The pump consists of an electrical 
power supply and an anode, which absorbs free 
ions between the tank walls. 


Cryogenic Tank Heaters 


Each hydrogen tank has one heater probe with 
two elements; each oxygen tank has two heater 
probes with two elements per probe. As the 
reactants are depleted, the heaters add heat 
energy to maintain a constant pressure in the 
tanks. 


The heaters operate in automatic and manual 
modes. In the automatic mode, the heater is 
controlled by a tank heater controller. Each 
heater controller receives a signal from a tank 
pressure sensor. If pressure in a tank is less than 
or equal to a specific pressure, the controller 
turns the heater on. When the pressure in the 
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tanks goes above the upper limit, the respective 
controller turns the heater off. The O2 TK1, 2, 3, 
and Н2 ТКІ, 2, 3 heater switches are located on 
panel R1; switches for the O2 and H2 ТКА heaters 
are on panel A11. The heater switches for tank set 
5 аге on panel А15. 


Heater controller psia 


Pressure limits High 
(psia) 
H; tank 1, 2 
H; tank 3-5 
О, tank 1,2 
O; tank 3-5 


200-206 
217-223 
803-819 
832-848 


220-226 
237-243 
838-854 
866-882 


О © © O оф © 


ЖАСЫН Aus) 


лю) 


TK! HEATERS— 
А——мто— 8 


02 апа H2 TK HEATERS Switches 
on Panel R1 


Dual-mode heater operation is available for pairs 
of oxygen and hydrogen tanks. If the heaters of 
both tanks 1 and 2, or tanks 3 and 4, are put in 
the automatic mode, the tank heater logic is 
interconnected. In this case, the heater 
controllers of both tanks must sense a low 
pressure before the heaters will turn on. Once 
they are on, a high pressure signal from either 
tank will turn off the heaters in both tanks. 


In the manual mode, the flight crew controls the 
heaters by using the ON OFF positions for each 
heaters switch on panel R1, А11, or А15. 
Pressure in each tank is shown as O2 TK P and 
H2 TK P on the DISP 68 CRYO SYSTEM display. 
Pressure is also displayed on the CRYO О» and 
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Н: PRESS meters on panel О2. The specific tank 
(1, 2, 3, 4, or 5) is selected by the rotary switch 
below the meters. 
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CRYO TANK 4 HEATER Switches 
on Panel A11 
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Cryogenic System Meters and Switches оп 
Panel O2 


Each tank set has a hydrogen/oxygen control 
box that contains the electrical logic for the 
hydrogen and oxygen heaters and controllers. 
The control box is located on cold plates in the 
midbody under the payload bay envelope. 
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DISP 68 CRYO SYSTEM Display (on orbit) 


The CRYO О» HTR ASSY TEMP meter on panel 
О2, in conjunction with the rotary switch below 
it, selects one of the two heaters in each tank and 
permits the temperature of the heater element to 
be displayed. The range of the display is from 
-425° F to +475° F. The temperature sensor in 
each heater also is hard-wired directly to the 
caution and warning system, which drives the 
yellow О› HEATER TEMP light on panel Е7. 
This light is illuminated if the temperature is at 
or above 344° F. A signal also is sent to the GPCs 
where software checks the limit; if the 
temperature is at or above 349° F, the BACKUP 
C/W ALARM light on panel F7 is illuminated. 
This signal also is displayed on SM SPEC 68 
CRYO SYSTEM and transmitted to the ground. 


Two current level detectors are built into the 
circuit of each oxygen tank heater to interrupt 
power in case of electrical shorts. The second 
detector is redundant. Each heater assembly has a 
corresponding set of detectors, A and B, which 
monitor the heater A current and the heater B 
current, respectively. The detectors are powered 
by circuit breakers on panels O14, O15, O16, апа 
ML86B. The detectors monitor the current going 
info and out of a heater. If the current difference 
is 0.9 amps or greater for 5 milliseconds, a trip 
signal is sent to the heater logic to remove power 
from the heaters, regardless of the heater switch 
position. Е one element of a heater causes a 
“trip-out,” power to both elements is removed. 
The О› TK 1, 2, 3 HEATERS RESET/ TEST 
switches on panel R1 and the O2 RESET/ TEST 
switches on panels А11 and A15 can be used to 
reapply power to that heater by positioning them 
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to RESET. The TEST position will cause a 1.5- 
amp delta current to flow through all four 
detectors of a specified oxygen tank, causing 
them to trip out. During on-orbit operations, the 
flight crew will be alerted to a current level 
detector trip-out by an SM ALERT, S68 CRYO 02 
message. 


OPERATIONAL INST 
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Cryogenic System Heater Sensor Circuit 
Breaker on Panel O14 


Each oxygen and hydrogen tank has a quantity 
sensor powered by a circuit breaker. These are 
identified on panel O13 as CRYO ОТҮ О» (or Н») 
TK 1 and TK 2 and on panel ML86B as CRYO 
QTY О» (or H2) TK 3, TK 4, and TK 5. Data from 
the quantity sensors are sent to panel O2, where 
the rotary switch below the meters is used to 
select the tank for display on the CRYO O» (or 
H2) QTY meters. The range of the meters is zero 
to 100 percent. The data are also displayed on 
SM SPEC 68. 
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Cryogenic System Heater Sensor Circuit 
Breaker on Panel O15 
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Cryogenic System Heater Sensor Circuit Breaker on Panel ML86B 
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Cryogenic System Heater Sensor Circuit 
Breaker on Panel O16 


There are two pressure sensors for each oxygen 
and hydrogen tank. One sensor transmits its 
data to the tank heater controllers, the caution 
and warning matrix on panel F7, and is 
displayed ав "Р" on SM SPEC 68. The yellow О» 
PRESS light is illuminated if oxygen tank 
pressure is below 540 psia or above 985 psia. The 
yellow Н: PRESS light illuminates if hydrogen 
tank pressure is below 153 psia or above 293.8 
psia. Data from the other sensor is displayed as 
TK P on SM SPEC 68 and the PRESS meters on 
panel О2. The SM ALERT and BACKUP C/W 
ALARM lights on panel F7 are also driven by the 
data. The range of the O2 meter is 0 to 1,200 psia. 
The Нь meter's range is 0 to 400 раја. The range 
of "P" displayed on the PASS and BFS SM SYS 
SUMM 1 and SM SPEC 68 and SM SPEC 168 is 
515 to 1,215 psia for oxygen and 145 to 305 psia 
for hydrogen. 
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O2 TK 1, TK 2 HEATERS RESET/TEST 
Switches on Panel R1 


Тһе data from oxygen and hydrogen fluid 
temperature sensors is displayed on SM SPEC 68 
and transmitted to the ground. 
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Cryogenic Tank Quantity Sensor Circuit Breakers on Panel ML86B 
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Cryogenic Tank Quantity Sensor Circuit 


Breakers on Panel O13 


Reactant Distribution 


The cryogenic reactants flow from the tanks 
through a relief valve/filter package module and 
a valve module. They then flow to the FCs 
through a common manifold. Hydrogen is 
supplied to the manifold from the tank at a 
pressure of 200 to 243 psia and oxygen is 
supplied at 803 to 883 psia. The pressure of the 
reactants will be essentially the same at the FC 
interface as it is in the tanks, since only a small 
decrease in pressure occurs in the distribution 
system. 


Each tank has a relief valve/filter package 
module that contains the tank relief valve and a 
12-micron filter. The filter removes contaminants 
that could affect the performance of components 
within the PRSD and the FCs. The valve relieves 
excessive pressure overboard that builds up in 
the tank. The oxygen tank relief valve relieves at 
1,005 psia and the hydrogen tank relief valve 
relieves at 302 psia. Tanks one and two also have 
a manifold relief valve that relieves pressure in 
the manifold lines. The manifold relief valves are 
a built-in safety device in the event a manifold 
valve and FC reactant valve are closed because of 
a malfunction. The reactants trapped in the 
manifold lines would be warmed up by the 
internal heat of the orbiter and overpressurize. 
The manifold relief valve will open at 290 psi for 
hydrogen and 975 psi for oxygen to relieve 
pressure and allow the trapped reactants to flow 
back to their tanks. 
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The reactants flow from the relief valve/filter 
packages through four reactant valve modules: 
two hydrogen (hydrogen valve modules 1 and 2) 
and two oxygen (oxygen valve modules 1 and 2). 
The valve modules contain a check valve for each 
cryogenic tank line to prevent the reactants from 
flowing from one tank to another in the event of 
a leak. This prevents a total loss of reactants. 
The oxygen valve modules also contain the 
environmental control and life support system 
atmosphere pressure control system 1 and 2 
oxygen supply valves. Each module also contains 
a manifold valve and FC reactant valves. 


Each FC has two reactant valves—one for 
hydrogen and one for oxygen. The valves are 
controlled by the FUEL CELL 1, 3, 2 REAC 
switches on panel R1. When the switch is 
positioned to OPEN, the hydrogen and oxygen 
reactant valves for that FC are opened and 
reactants are allowed to flow from the manifold 
into the FC. When the switch is positioned to 
CLOSE, the hydrogen and oxygen reactant valves 
for that FC are closed, isolating the reactants from 
the FC and rendering that FC inoperative. Each 
FUEL CELL REAC switch on panel R1 also has 
two talkback indicators, one on each side of the 
switch. The corresponding talkback indicates OP 
when the valve is OPEN and CL when the valve 
is closed. There is redundant capability to close 
the REAC VALVES via the FUEL CELL REAC 
VLV circuit breakers and switches on panel C3. 
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FUEL CELL 1, 3, 2 REAC Switches and 
Talkbacks on Panel R1 


WARNING 

The FUEL CELL REAC switches on panel R1 
are in a vertical column with FUEL CELL 1 
REAC on top, FUEL CELL 3 REAC in the 
middle, and FUEL CELL 2 REAC on the 
This was done to allow the 
schematic to be placed on the panel. 
Because the switches are not in numerical 
order, it is possible to inadvertently close the 
wrong FC reactant valve when shutting 
down a FC. 


bottom. 


It is critical to have reactants available to the FCs. 
When any FC reactant valve is closed, the red 
FUEL CELL REAC light on panel F7 is 
illuminated and a caution/warning tone is 
sounded. The computers sense the closed valve, 
which causes the BACKUP C/W ALARM light on 
panel F7 to be illuminated, an SM ALERT to 
occur, and a closed indication to be displayed on 
SM SPEC 69 and SM SYS SUMM 1. This alerts 
the flight crew that the FC will be inoperative 
within approximately 20 to 30 seconds for a 
hydrogen valve closure and 90 seconds for an 
oxygen valve closure. The time varies with 
power loading. 


The О; and Н> MANIFOLD VLV switches on 
panel R1 control the respective hydrogen and 
oxygen manifold valves. When the two hydro- 
gen and two oxygen manifold valves are in the 
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CLOSE position, ЕС 1 receives reactants from 
cryogenic tank set 1, FC 2 receives reactants from 
cryogenic tank set 2, and FC 3 receives reactants 
from cryogenic tank sets 3 and above. ECLSS 
atmosphere pressure control system 1 receives 
oxygen from oxygen tank 1, and system 2 
receives oxygen from oxygen tank 2. When the 
switches are positioned to CLOSE, the talkback 
indicator associated with each switch indicates 
CL. 


With both Н; апа О; MANIFOLD УГУ 1 switches 
positioned to OPEN and the MANIFOLD VLV 2 
switches positioned to CLOSE, cryogenic tanks 1, 
3 and above supply hydrogen to FCs 1 and 3, and 
oxygen cryogenic tanks 1, 3 and above supply 
oxygen to FCs 1 and 3, as well as to ECLSS 
atmosphere pressure control system 1. The 
talkback indicator associated with each MANF 
VLV 1, 2 switch indicates OP, CL, respectively. 
Oz and H: TK 2 continue to supply FC 2. 
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О2 and H2 MANIFOLD УГУ Switches and 
Talkbacks on Panel R1 


CAUTION 


There are no relief valves for О» and Н» 
manifold 3's with manifold valves 1 and 2 
This configuration should be 
avoided except for leak isolation and 
troubleshooting. 
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When the Н» and О; MANIFOLD МГМ 2 
switches are positioned to OPEN, and the 
MANIFOLD VLV 1 switches are positioned to 
CLOSE, hydrogen cryogenic tanks 2 and 3 and 
above supply hydrogen to FCs 2, 3, and oxygen 
cryogenic tanks 2 and 3 and above supply 
oxygen to FCs 2 and 3, as well as to ECLSS 
atmosphere pressure control system 2. The 
talkback indicator associated with each MANF 
VLV 1, 2 switch indicates OP, CL, respectively. 
Н» and О» tank 1 continue to supply FC 1. 


With the Н» and O2 MANIFOLD УГУ 1 and 2 
switches positioned to OPEN, all hydrogen 
cryogenic tanks are available to supply hydrogen 
to all three FCs, and all oxygen cryogenic tanks 
are available to supply oxygen to all three FCs, as 
well as to ECLSS atmosphere pressure control 
systems 1 and 2. Because tank sets 1 and 2 are 
regulated at a slightly lower pressure, tank sets 3 
and above will feed before tank set 1 and 2. 
Reactants will be supplied to the FCs by the 
tank(s) with the highest pressure. 


Manifold pressure data from two pressure 
sensors located in the respective hydrogen and 
oxygen valve modules is displayed on SM SPEC 
68 CRYO SYSTEM. This information is also sent 
to the systems management computer where its 
lower limit is checked. If the respective hydro- 
gen and oxygen manifold pressures are below 
150 psia and 200 psia respectively, an SM ALERT 
will occur. 


Fuel Cell System 


The three FCs are located under the payload bay 
liner in the forward portion of the orbiter's 
midfuselage. Each FC is 14 inches high, 15 inches 
wide, 40 inches long, and weighs 255 pounds. 
Each FC is reusable and restartable. The three FCs 
are individually coupled to the PRSD subsystem, 
the active thermal control system (ATCS), the 
supply water storage subsystem, апа the 
electrical power distribution and control (EPDC) 
subsystem. The FCs generate heat and water as 
by-products of electrical power generation. The 
excess heat is directed to the FC heat exchanger, 
where it is rejected to the Freon coolant loops. 
The water is directed to the supply water storage 
subsystem for the environmental control and life 
support system. 
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Fuel Cell Block Diagram 


The nominal voltage and current range of each 
FC is 32.5 volts DC at 2 kW (61.5 amps), 
decreasing to 27.5 volts DC at 12 kW (436 amps). 
Each is capable of supplying up to 10 kW 
maximum continuous power in nominal 
situations, 12 kW continuously in off-nominal 
situations (with one or more FCs failed), and up 
to 16 kW for 10 minutes. The average on-orbit 


power consumption of the orbiter is 
approximately 14 kW, leaving additional 
capability available for payloads. Each FC is 


serviced between flights and reused until it has 
accumulated 2,000 hours of on-line service. 


The orbiter’s three FCs operate as independent 
electrical power sources, each supplying its own 
isolated, simultaneously operating DC bus. Each 
FC consists of a power section and an accessory 
section. The power section, where hydrogen and 
oxygen are transformed into electrical power, 
water, and heat, consists of 96 cells contained in 
three substacks. Manifolds run the length of 
these substacks and distribute hydrogen, oxygen, 
and coolant to the cells. The cells contain an 
oxygen electrode (cathode), and a hydrogen 
electrode (anode) that are separated by a porous 
matrix saturated with potassium hydroxide 
electrolyte. 
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The accessory section monitors the reactant flow, 
removes waste heat and water from the chemical 
reaction, and controls the temperature of the 
stack. The accessory section consists of the 
hydrogen and oxygen flow system, the coolant 
loop, and the electrical control unit. 


The ГС generates power through ап 
electrochemical reaction of hydrogen and 
oxygen. At the hydrogen electrode (anode), 
hydrogen is oxidized according to the following 
reaction: 


2H, + ДОН- — — —» 4H,O + Де" 


forming water and releasing electrons. At the 
oxygen electrode (cathode), oxygen is reduced in 
the presence of water. It forms hydroxyl ions 
according to the following relationship: 


О, + 2H,O + де ————>» ЛОН” 


The net reaction consumes one oxygen molecule 
and two hydrogen molecules in the production 
of two water molecules, with electricity and heat 
formed as by-products of the reaction. 


The FC coolant system circulates а liquid 
fluorinated hydrocarbon and transfers the waste 
heat from the cell stack through the FC heat 
exchanger to the Freon coolant loop system in the 
midfuselage. Internal control of the circulating 
fluid maintains the cell stack at a load-dependent 
operating temperature of approximately 200° F. 
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When the reactants enter the FCs, they flow 
through a preheater (where they are warmed 
from a cryogenic temperature to 40° F or greater), 
a 6-micron filter, and a two-stage, integrated dual 
gas regulator module. The first stage of the 
regulator reduces the pressure of the hydrogen 
and oxygen to 100 to 120 psia. The second stage 
reduces the oxygen pressure to a range of 60 to 
65 psia and maintains the hydrogen pressure at 
4.5 to 6 psia differential below the oxygen 
pressure. The regulated oxygen lines are 
connected to the accumulator, which maintains 
an equalized pressure between the oxygen and 
the FC coolant. If oxygen and hydrogen pressure 
decrease, the coolant's pressure is also decreased 
to prevent a large differential pressure inside the 
stack that could deform the cell stack structural 
elements. 


Upon leaving the dual gas regulator module, the 
incoming hydrogen mixes with the hydrogen- 
water vapor exhaust from the FC stack. This 
saturated gas mixture is routed through a 
condenser, where the temperature of the mixture 
is reduced, condensing a portion of the water 
vapor to form liquid water droplets. The liquid 
water is then separated from the hydrogen-water 
mixture by the hydrogen pump  /water 
separator. A centrifugal water separator extracts 
the liquid water and pressure-feeds it to potable 
tanks in the lower deck of the pressurized crew 
cabin. Water from the potable water storage 
tanks can be used for crew consumption and for 
cooling the Freon loops by feeding the flash 
evaporator system. 
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The hydrogen pump uses three-phase AC power 
to circulate the hydrogen gas back to the FC 
stack, where some of the hydrogen is consumed 
in the reaction. The remainder flows through the 
FC stack, removing the product water vapor 
formed at the hydrogen electrode. The 
hydrogen-water vapor mixture then combines 
with the regulated hydrogen from the dual gas 
generator module and the loop begins again. The 
performance at the pump is monitored via the H2 
pump status voltage display on SM SPEC 69. 


The oxygen from the dual gas regulator module 
flows directly through two ports into a closed- 
end manifold in the FC stack, achieving optimum 
oxygen distribution in the cells. All oxygen that 
flows into the stack is consumed, except during 
purge operations. 


Reactant consumption is directly related to the 
electrical current produced: if there are no 
internal or external loads on the FC, no reactants 
will be used. Because of this direct proportion, 
leaks may be detected by comparing reactant 
consumption with current produced. Ап 
appreciable amount of excess reactants used 
indicates a probable leak. 
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Water Removal 


Water and electricity are the products of the 
oxidation/reduction reaction of oxygen and 
hydrogen that takes place in the FCs. The water 
must be removed or the cells will become 
saturated with water, decreasing reaction 
efficiency. With an operating load of about 7 kW, 
it takes only 110 amp-hr or approximately 20 
minutes to flood the FC with produced water, 
thus effectively halting power generation. 
Hydrogen is pumped through the stack and the 
portion that is not consumed in the reaction acts 
as a carrier gas, picking up and removing water 
vapor on the way. After being condensed, the 
liquid water is separated from the hydrogen by 
the hydrogen pump/water separator and 
discharged from the FC to be stored in the ECLSS 
potable water storage tanks. 


Product water is routed to tank A; when tank A 
is full, it is routed to tank B, then tanks C and D. 
An alternate water delivery path is also available 
to deliver water to the ECLSS tanks if the 
primary path is lost. If the water tanks are full, or 
there is line blockage, the water relief valves open 
at 45 psia to allow the water to vent overboard 
through the water relief line and nozzle. Check 
valves prevent water tanks from discharging 
through an open relief valve. 


For redundancy, two thermostatically activated 
heaters are wrapped around the discharge and 
relief lines to prevent blockage caused by the 
formation of ice in the lines. Two switches on 
panel К110, H,O LINE HTR and ЊО RELIEF 
HTR, provide the flight crew with the capability 
to select either A AUTO or B AUTO for the FC 
water discharge line heaters and the water relief 
line and vent heaters respectively. 


Thermostatically controlled heaters will maintain 
the water line temperature above 53° F when 
required. The normal temperature of product 
water is approximately 140° to 150° F. 
Thermostatically controlled heaters also maintain 
the water relief valve’s temperature when in use 
between 70° to 100° F. 


FC 1, 2, or 3 DC voltage and current can be 
monitored on the DC VOLTS and DC 
AMPS/SIG STR meters on panel F9, using the 
rotary switch below the meters to select a specific 
FC, and on SM SPEC 69. Temperature sensors 
located on the FC water discharge line, relief 
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valve, relief line, and vent nozzle are displayed 
on SM SPEC 69 FUEL CELLS. 


If the potassium hydroxide electrolyte in any FC 
migrates into the product water, a pH sensor 
located downstream of the hydrogen 
pump/ water separator will sense the presence of 
the electrolyte and alert the crew via an SM 
ALERT and display on SM SPEC 69. A common 
pH sensor is located downstream of the interface | 
between each FC's primary water path, prior to 
entering the ECLSS supply H20 tanks. 
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Fuel Cell Purge 


During normal FC operation, the reactants are 
present in a closed-loop system and either 
consumed in the production of electricity or 
recirculated through the stack. Any inert gases 
or other contaminants will accumulate in and 
around the porous electrodes in the cells and 
reduce the reaction efficiency and electrical load 
support capability. Purging is performed 
periodically to cleanse the cells. The purge 
sequence can be controlled manually by the crew, 


2.8-15 


USA007587 
Rev. A 


automatically by flight software, or via 
commands sent by Mission Control. When a 
purge is initiated by opening the purge valves, 
the oxygen and hydrogen systems become open- 
loop systems; increased flows allow the reactants 
to circulate through the stack, pick up the 
contaminants, and blow them overboard through 
the purge lines and vents. Electrical power is 
produced throughout the purge sequence. No 
more than 10 kilowatts (350 amps) should be 
required from a FC being purged because of the 
increased reactant flow and preheater limitations. 


FC purges can be activated automatically or 
manually via switches on panel R11U. At the 
initiation of either an auto or manual purge, the 
purge line heaters are turned on to heat the purge 
lines and ensure that the reactants do not freeze 
in the lines. The hydrogen reactant is the more 
likely to freeze because it is saturated with water 
vapor. Depending on orbit trajectory and vehicle 
orientation, the heaters may require 27 minutes 
to heat the lines to the required temperatures. 
Because of limitations on the hydrogen and 
oxygen preheaters in the FCs, the crew checks the 
FC current to ensure each FC has a load of less 
than 350 amps. As the current output of the FC 
increases, the reactant flow rates increase and the 
preheaters raise the temperature of the reactants 
to a minimum of 40° F to prevent the seals in the 
dual gas regulator from freezing before purging. 
At loads greater than 350 amps, additional flow 
during a purge would exceed the maximum flow 
the preheaters are capable of warming. The crew 
also checks that the FC is not shut down, that 
time to deorbit is more than 3 hours, and, for an 
automatic purge, that an SM OPS transition is not 
scheduled within the next hour. An SM OPS 
transition will halt the automatic purge sequence. 
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FUEL CELL Purge Switches on Panel R11U 


The purge lines from all three FCs are 
manifolded together downstream of their purge 
valves and associated check valves. The line 
leading to the purge outlet is sized to permit 
unrestricted flow from only one FC at a time. 


NOTE 


If more than one FC is purged 
simultaneously, back pressure may build 
in the purge line. Due to the sizing of the 
hydrogen and oxygen purge lines, the back 
pressure in the Н» line can cause the 
hydrogen pressure to rise above the 
oxygen pressure. Although the dual gas 
regulator is designed to prevent this from 
happening, it is not advisable to expose all 
three FCs to this condition at the same 
time. If there is a generic problem with the 
dual gas regulator, it could cause all three 
FCs to fail simultaneously. 


For an automatic purge, the FUEL CELL PURGE 
heater switch is positioned to GPC and the FUEL 
CELL PURGE VALVES 1, 2, and 3 switches on 
panel R11U are positioned to GPC. The FUEL 
CELL GPC PURGE SEQ switch is then positioned 
to START and must be held until 3 seconds after 
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the talkback indicator beside the switch indicates 
gray. The automatic purge sequence will not 
begin if the indicator indicates barberpole. First, 
the GPC turns the purge line heaters on and 
monitors the temperature of the lines. The one 
oxygen line temperature sensor must register at 
least 69° Е and the two hydrogen line 
temperature sensors 79° F and 40° F, respectively, 
before the purge valves will open. When the 
proper temperatures have been reached, the GPC 
will open the hydrogen and oxygen purge valves 
for FC 1 for 2 minutes, close them, and then 
repeat the process for FCs 2 and 3. If a FUEL 
CELL PURGE VALVE switch is not in the GPC 
position, the software purge sequence will skip 
that FC and continue to the next FC in the 
sequence. If the temperatures are not up to the 
minimum limit after 27 minutes, the GPC will 
issue an SM ALERT, display the data on SM 
SPEC 69, and stop the auto sequence. Thirty 
minutes after the FC 3 purge valves have been 
closed (to ensure that the purge lines have been 
totally evacuated of water vapor by the heaters), 
the GPC will turn off the purge line heaters. This 
provides sufficient time and heat to bake out any 
remaining water vapor. If the heaters are turned 
off before 30 minutes have elapsed, water vapor 
left in the lines may freeze. The GPC purge 
sequence start can also be initiated using the 
SPEC 60 SM TABLE MAINT display. The 
sequence is normally performed by Mission 
Control uplink on orbit. 


The flight crew, using the switches on panel 
R11U, would also initiate a manual FC purge. In 
the manual mode, the three FCs must be purged 
separately. The FUEL CELL PURGE HEATER 
switch is positioned to ON for the same purpose 
as in the automatic mode, and the flight crew 
verifies that the temperatures of the oxygen line 
and two hydrogen lines are at the same 
minimum temperatures as in the automatic mode 
before the purge sequence is initiated. The FUEL 
CELL PURGE VALVE 1 switch is then positioned 
to OPEN for 2 minutes and the flight crew 
observes that the oxygen and hydrogen flow 
rates increase on SM SPEC 69. The switch is then 
positioned to CLOSE, and a decrease in the 
oxygen and hydrogen flow rates is observed on 
SM SPEC 69, confirming the purge valves are 
closed. FC 2 is purged in the same manner using 
the FUEL CELL PURGE VALVES 2 switch. Then 
FC 3 is purged in the same manner using the 
FUEL CELL PURGE VALVES 3 switch. After the 
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30-minute line bakeout period, the FUEL CELL 
PURGE HEATER switch is positioned to OFF. 
Manual purges use different heaters than 
automatic purges. At least one manual purge is 
scheduled per flight. 


Fuel Cell Cooling/Temperature Control 


To cool the FC stack during its operations, 
distribute heat during FC start-up, and warm the 
cryogenic reactants entering the stack, the FC 
circulates fluorinated hydrocarbon throughout 
the FC. The FC coolant loop and its interface 
with the ECLSS Freon coolant loops are identical 
in FCs 1, 2, and 3. 


The temperature of the coolant returning from 
the Freon coolant loops is sensed before it enters 
the FC. This is displayed as COOL T on SM 
SPEC 69. It then enters the FC and passes 
through a 75-micron filter. After the filter, two 
temperature-controlled mixing valves allow 
some of the hot coolant to mix with the cool 
returning coolant to prevent the condenser exit 
control valve from oscillating. The control valve 
adjusts the flow of the coolant through the 
condenser to maintain the hydrogen-water vapor 
exiting the condenser at a temperature between 
148° and 153° F. 


The stack inlet control valve maintains the 
temperature of the coolant entering the stack 
between 177° and 187° F. The accumulator 
interfaces with the oxygen cryogenic reactant to 
maintain an equalized pressure between the 
oxygen and the coolant (the oxygen and 
hydrogen pressures are controlled at the dual gas 
regulator) to preclude a high pressure differential 
in the stack. The pressure in the coolant loop is 
sensed before the coolant enters the stack and is 
displayed as COOL P on SM SPEC 69. 


The coolant is circulated through the FC stack to 
absorb the waste heat from the 
hydrogen/oxygen reaction occurring in the 
individual cells. After the coolant leaves the 
stack, its temperature is sensed and the data is 
displayed on the FUEL CELL STACK TEMP 
meter through the three-position switch located 
below the meter on panel O2 and on the SM 
SPEC 69 display as STACK T. The yellow FUEL 
CELL STACK TEMP, the red BACKUP C/W 
ALARM light, and the SM ALERT light on panel 
F7 will be illuminated if FC апа stack 
temperatures exceed upper or lower limits. The 


2.8-17 


USA007587 
Rev. A 


hot coolant from the stack flows through the 
oxygen and hydrogen preheaters where it warms 
the cryogenic reactants before they enter the 
stack. 


The coolant pump utilizes three-phase AC power 
to circulate the coolant through the loop. The 
differential pressure sensor senses a pressure 
differential across the pump to determine the 
status of the pump. The FUEL CELL PUMP light 
on panel F7 will be illuminated if FC 1, 2, or 3 
coolant pump delta pressure is lost and a fault 
message will be sent to the DPS display. If the 
coolant pump for FC 1, 2, ог З is off, the BACKUP 
C/W ALARM light will be illuminated and a fault 
message and a APY will be displayed. 


The temperature-actuated flow control valve 
downstream from the pump adjusts the coolant 
flow to maintain the FC coolant exit temperature 
between 190? and 210? F. The stack inlet control 
valve and flow control valve have bypass orifices 
to allow coolant flow through the coolant pump 
and to maintain some coolant flow through the 
condenser for water condensation, even when the 
valves are fully closed due to the requirements of 
thermal conditioning. The hot coolant that is not 
used at the mixing valves exits the FCs to the FC 
heat exchanger where it transfers its excess heat 
to be dissipated through the ECLSS Freon coolant 
loops in the midfuselage. 
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Electrical Control Unit 


The electrical control unit located in each FC 
power plant contains the startup logic, heater 
thermostats, 30-second timer, and interfaces with 
the controls and displays for FC startup, 
operation, and shutdown. The unit controls the 
supply of AC power to the coolant pump, 
hydrogen pump/water separator and the pH 
sensor. It also controls the DC power supplied to 
the flow control bypass valve (open only during 
startup) and the internal startup and sustaining 
heaters. It also controls the status of the FUEL 
CELL 1, 2, 3 READY FOR LOAD and COOLANT 
PUMP AP talkback indicators on panel R1. 


The nine FC circuit breakers that connect three- 
phase AC power to the three FCs are located on 
panel L4. Each FC electrical control unit (ECU) 
receives its power from an essential bus through 
the FC CNTLR switch on panels O14, O15, and 
O16. 
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Cell Performance Monitor 


As ЕС life increased with the introduction of the 
third substack, the likelihood of individual cell 
failures caused by “wearout” or age increased. 
Consequently, the design of the cell performance 
monitor (CPM) was intended to detect individual 
cell performance problems or imminent failures 
such as cell crossover. 


Crossover is defined as an uncontrolled mixing 
of the reactants that results in the generation of 
excessive product heat. The combination of 
hydrogen and oxygen requires little heat to 
explode. During normal FC operation, hydrogen | 
and oxygen are diffusely mixed to produce 
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electricity. The matrix, a fibrous asbestos blotter 
device within each cell, holds the KOH 
electrolyte and limits the H2/O2 mixing. 
Crossover occurs when the matrix fails to do its 
job. A manufacturing flaw in the matrix or an 
impurity in the matrix fibers may cause a pin 
hole to develop after hours and hours of 
exposure to the caustic KOH in the presence of 
the waste heat within the cell. 


As the direct combination of the reactant 
molecules occurs at the pin hole, increased waste 
heat may cause the pin hole to burn and enlarge, 
allowing more reactants to combine. Ш this 
reaction continues, it might propagate 
uncontrollably and possibly cause а violent 
explosion. Crossover may proceed rapidly or 
gradually. Before the introduction of the cell 
performance monitor (CPM) prior to STS-9, the 
electrical performance indicators of a crossover- 
distressed cell were not detectable, since the lost 
electrical performance of the substack with the 
degraded cell was picked up by the healthy 
substacks. 


The CPM compares each half substack voltage 
and calculates a delta volts measurement. By 
comparing both halves of a substack, the CPM 
can detect cell changes. Since all the cells in a 
substack are producing the same current, both 
halves of the substack should be а: 
approximately identical voltages. Ideally AV = 0, 
but small fluctuations are common. A significant 
voltage loss in any one cell will produce a change 
in the AV with 300 mV being a critical 
performance loss. AV can be either positive or 
negative, so the CPM converts the 
positive/negative AV between the upper and 
lower substack halves to an absolute value and 
then outputs that value (0 to 500 mV). To 
provide margin and accommodate the absolute 
value, the C/W limit is set at 150 mV. The 
output is then converted to a 0 to 5 V DC signal 
for telemetry and crew display systems by a 
“times 10” amplifier. Calibration curves rescale 
this to electronic units (EU) (0 to 50 mV). 


Every 7.5 minutes the CPM performs a self-test to 
ensure data accuracy and to prevent FC 
shutdown due to faulty data. During the self-test 
period: 


e The voltage measurement of the substack 
halves ceases. 
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e A test signal of 50 mV is input to the 
voltage measurement logic. 


e The output of the “times 10” amplifier is 
examined for 425 to 575 mV. 


e If the test fails, the output voltage is driven 
to 5 volts until the next self-test is 
performed 7 +1 minute later. A test voltage 
of 50 mV is introduced and the sequence 
repeats itself. 


e If the self-test is passed, the unit resumes 
substack half voltage measurements. 


Fuel Cell Monitoring System 


The fuel cell monitoring system (FCMS) is a data 
collection system that provides insight into the 
single cell voltages in the orbiter FC powerplants. 


The FCMS is a PGSC program that records 
voltage in each individual cell as well as in all 
three FCs and saves these readings into an ASCII 
data file. This file is then downlinked to MCC for 
evaluation. 


FCMS has two recording modes, full rate and 
interval. Full rate records a sample every second 
until the maximum file size is reached. In 
interval, FCMS records samples at crew-specified 
intervals for a certain amount of time, also 
specified by the crew. In this mode, if the 
amount of data exceeds maximum file size, the 
crew receives a message that the program will 
stop recording when the maximum size is 
reached. File size is limited to 1.44 Mb to ensure 
that it will fit onto a single floppy disk, although 
flash drives are currently used on board. 


One data sample consists of a GMT time tag for 
FC 1 - the cell 1 reading followed by 288 voltage 
readings; i.e., 96 cells/ ЕС powerplant times 3 ЕС 
powerplants. 


FCMS uses the PCMMU 2 port on the flight deck 
(panel O5) and a special FCMS cable to collect 
data for the PGSC program. FCMS data also can 
be recorded prelaunch directly through the T-0 
umbilicals. 


Baseline recordings normally are recorded at the 
beginning of each mission for comparison in the 
event of a subsequent failure. 
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Fuel Cell Start 


The FUEL CELL START/STOP switches on panel 
К1 are used to initiate the start sequence or stop 
the FC operation. When a switch is held in its 
momentary START position, the ECU connects 
the three-phase AC power to the coolant pump 
and hydrogen pump/water separator (allowing 
the coolant and the hydrogen-water vapor to 
circulate through these loops) and connects the 
DC power to the internal startup and sustaining 
heaters and the flow control bypass valve. The 
switch must be held in the START position until 
the COOLANT PUMP AP talkback (tb) shows 
gray (approximately 3 to 4 seconds), which 
indicates that the coolant pump is functioning 
properly by creating a differential pressure across 
the pump. When the COOLANT PUMP AP tb 
indicates barberpole, the coolant pump is not 
running. 


The READY FOR LOAD tb for each FC shows 
gray after the 30-second timer times out or when 
the stack-out temperature is above 187° F, 
whichever occurs last. Stack-out temperature can 
be monitored on the SM SYS SUMM 1 (STACK 
T) and SM SPEC 69 FUEL CELLS displays 
(STACK T). It can also be monitored on the 
FUEL CELL STACK OUT TEMP meter on panel 
О2, using the switch beneath the meter to select 
the FC. When the READY FOR LOAD tb shows 
gray, the FC is up to the proper operating 
temperature and is ready for loads to be attached 
to it. It should not take longer than 25 minutes 
for the FC to warm up and become fully 
operational; the actual time depends on the FC's 
initial temperature. The READY FOR LOAD 
indicator remains gray until the FUEL CELL 
START/STOP switch for each FC is set to STOP, 
the FC CNTLR switch on the overhead panel is 
set to OFF, or the essential bus power is lost to 
the ECU. 
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SM SYS SUMM 1 (SPEC 78) 


Electrical Power Distribution and Control 


The electrical power distribution and control 
(EPDC) subsystem controls and distributes AC 
and DC electrical power to the orbiter 
subsystems, the solid rocket boosters, the 
external tank, and payloads. The 28 volts DC 
generated by each of the three FCs is distributed 
to а main DC bus. The three main DC buses (MN 
A, MN B, and MN C) are the prime sources of 
power for the vehicle's DC loads. Each DC main 
bus supplies power to three solid-state (static), 
single-phase inverters, which in-turn powers 
their respective AC bus. These three inverters are 
phase sequenced with each other to provide 
three-phase alternating-current (ac). Thus a total 
of nine inverters convert DC power to 117 volt 
(rms), 400-hertz AC power for distribution to 
three AC buses (AC 1, AC 2, and AC 3) for the 
vehicle's AC loads. 
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Bus System 


The three main DC buses are main A (MN А), 
main B (MN B), and main C (MN C). Three AC 
buses, AC 1, AC 2, and AC 3, supply AC power 
to the AC loads. Three essential buses, ESS 1BC, 
ESS 2CA, and ESS 3AB, supply DC power to 
selected flight crew controls and electrical loads 
that are deemed essential. Nine control buses - 
CNTL АВ 1, 2, 3; CNTL BC 1, 2, 3; and CNTL CA 
1, 2, 3 - are used to supply control power to flight 
crew controls. Two preflight buses, PREFLT 1 
and PREFLT 2, are used only during ground 
operations. 
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Depending on the criticality of orbiter electrical 
equipment, some electrical loads may receive 
redundant power from two or three main buses. 
If an electrical load receives power from two or 
three sources, it is for redundancy only and not 
for total power consumption. 


DC Power 


Main Buses 


The main buses distribute DC electrical power 
from the FCs to locations throughout the orbiter. 
Distribution assemblies handle the routing of 
main bus power. 
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CONTROL BUS Circuit Breakers on Panel R14 


Essential Buses 


Essential buses supply power to switches that are 
necessary to restore power to a failed main DC or 
AC bus and to essential electrical loads and 
switches. In some cases, essential buses are used 
to power switching discretes to 
multiplexers/ demultiplexers. Examples of the 
selected flight crew switches and loads are the 
EPS switches, GPC switches, TACAN, radar 
altimeter and microwave scan beam landing 
system power switches, the caution and warning 
system, emergency lighting, audio control panel, 
and master timing unit. 


Three essential buses, ESS 1BC, ESS 2CA, and 
ESS 3AB receive power from three redundant 
sources. For example, ESS 1BC receives DC 
power from FC 1 through the ESS BUS SOURCE 
FC 1 switch on panel R1 via a fuse when the 
switch is positioned to ON, and from main DC 
buses B and C through remote power controllers 
(RPCs) when the ESS BUS SOURCE MN B/C 
switch on panel К1 is positioned to ON. 
Electrical power is then distributed from the 
essential bus in distribution assembly 1 through 
fuses to the corresponding controller assemblies 
and to the flight and middeck panels. 
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Control Buses 


Nine control buses supply control power to the 
display and control panel switches on the flight 
deck and in the middeck area. A control bus 
does not supply operational power to any system 
loads. Each control bus receives power from 
each main DC bus for redundancy. The main 
buses identified in the control bus name аге 
connected through RPCs and diodes. For 
example, CNTL ВС1 is powered by MN B and 
MN C through RPCs. Тһе "unnamed bus", 
which in this example is MN A, provides power 
to the control bus through a circuit breaker and a 
fuse. The number in each control bus name does 
not refer to a power source for the bus; it is 
merely a numeric designator for the bus. 


The control buses are enabled by the CONTROL 
BUS PWR MN A, MN B, and MN C switches on 
panel КІ and the MN A CONTROL BUS 
BC1/2/3, the MN B CONTROL BUS CA1/2/3 
and the MN C CONTROL BUS АВ1/2/3 circuit 
breakers on panel R14. 


2.8-24 


— \О/ POWER DISTRIBUTION 
BUS PWR 


T—— ESS BUS SOURCE——, MN BUS TIE 
1 
A 


tss FON FO/MAIN BUS — 
5 FC 1 А 
180 |] ох 1 


) m| 


Bus Control Switches and Talkbacks 
on Panel R1 


The RPCs are powered continuously unless one 
of the CONTROL BUS PWR MN A, MN B, MN C 
momentary switches on panel R1 is positioned to 
the RESET position, which turns the 
corresponding RPCs power off and resets the 
RPC if it has been tripped off. An SM ALERT 
light is illuminated if the control bus voltage is 
less than 24.5 volts DC and a fault message is sent 
to the DPS display. The Mission Control Center 
can monitor the status of each RPC. 


Payload Buses 


Payload buses are provided to supply DC 
electrical power to the payloads. FC 3 may be 
connected to the primary payload bus by 
positioning the PRI FC3 momentary switch on 
panel R1 to the ON position. The talkback 
indicator above the switch will indicate ON when 
FC 3 is connected to the PRI PL bus. The PRI PL 
bus is the prime bus for supplying power to the 
payloads. FC 3 may be disconnected from the 
payload bus by positioning the PRI FC3 switch to 
the OFF position. The talkback indicator above 
the switch will indicate OFF. 


A second source of electrical power for the PRI 
PL bus may be supplied from the MN B bus by 
positioning the PRI MN B momentary switch on 
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panel R1 to the ON position. The talkback 
indicator above this switch will indicate ON. The 
MN B bus may be removed from the PRI PL bus 
by positioning the switch momentarily to OFF. 
The talkback indicator will indicate OFF. A third 
possible source of electrical power for the PRI PL 
bus may be supplied from the MN C bus through 
the PRI MN C switch on panel R1, positioned 
momentarily to the ON position. The talkback 
indicator will indicate ON. The MN C bus may 
be removed from the PRI PL bus by positioning 
the switch momentarily to OFF. The talkback 
indicator will indicate OFF. 


NOTE 


Main buses B and C can be tied via the PRI 
PL bus. This is referred to as a "backdoor 
bus tie." 


Two additional payload buses are located in the 
aft section of the payload bay at the aft bulkhead 
station. The aft payload B bus may be powered 
up by positioning the AFT MN B switch on panel 
К1 to ON. The aft payload С bus may be 
powered up by positioning the AFT MN C switch 
on panel R1 to ON. The OFF position of each 
switch removes power from the corresponding 
aft payload bus. 


The AUX switch on panel R1 permits main bus A 
and main bus B power to be supplied to the AUX 
PL A and AUX PL B buses when the switch is 
positioned to ON. The auxiliary payload buses 
can provide power for emergency equipment or 
controls associated with payloads. The OFF 
position removes power from the AUX PL A and 
PL B buses. The two auxiliary payload buses 
may be dioded together to form one bus for 
redundancy. 


The CABIN switch on panel R1 provides MN A 
or MN B power to patch panels located behind 
the payload specialist and mission specialist 
stations on the aft flight deck. These patch panels 
supply power to the payload-related equipment 
located on panels at these stations. Two three- 
phase circuit breakers, AC 2 PAYLOAD 3¢ and 
АС 3 PAYLOAD Зфоп panel MA73C, provide AC 
power to the payload patch panels. 
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AC Power Generation 


AC power is generated and made available to 
system loads by the EPDC subsystem using three 
independent AC buses, AC 1, AC 2, and AC 3. 
The AC power system includes the AC inverters 
for DC conversion to AC апа inverter 
distribution and control assemblies containing 
the AC buses and the AC bus sensors. The AC 
power is distributed from the inverter 
distribution and controller assemblies to the 
flight and middeck display and control panels 
and from the motor controller assemblies to the 
three-phase motor loads. 
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АС2 Cabin PAYLOAD 3© апа АСЗ Cabin PAYLOAD 30 Circuit Breakers 
on Panel MA73C 


Each AC bus consists of three separate phases 
connected in a three-phase array. Static invert- 
ers, one for each phase, are located in the 
forward avionics bays. Each inverter has ап 
output voltage of 117 volts (rms) at 400 hertz. 


Input power to the inverters is controlled by the 
INV PWR 1, 2, 3 switches on panel R1. INV 
PWR 1 routes power to AC 1 from MN A, INV 
PWR 2 to AC 2 from MN B, and INV PWR 3 to 
АС 3 from MN С. АП three inverters of АС 1 
receive MN A bus power when the INV PWR 1 
switch is positioned to ON, and all three must be 
in operation before the talkbacks above the 
switches indicate ON. The indicators will show 
OFF when main bus power is not connected to 
the inverters. The INV/AC BUS 1, 2, 3 switches 
on panel R1 are used to apply each inverter's 
output to its respective AC bus. An indicator 
above each switch shows its status, and all three 
inverters must be connected to their respective 
AC buses before the indicators show ON. The 
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talkback indicators will show OFF when any of 
the phases are not connected to their respective 
AC bus. 


The INV PWR and INV/AC BUS switches and 
talkbacks must have control power from the AC 
CONTR circuit breakers on panel R1 in order to 
operate. Once AC power has been established, 
these circuit breakers are opened to prevent any 
inadvertent disconnection, whether by switch 
failure or accidental movement of the INV PWR 
or INV/ AC BUS switches. 


Electrical Power Distribution and 
Control Assemblies 


Electrical power is controlled and distributed by 
assemblies. Each assembly (main distribution 
assembly, power controller assembly, load con- 
troller assembly, and motor controller assembly) 
is in an electrical equipment container. 
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Distribution Assemblies 


The DC power generated by each of the FCs is 
supplied to а corresponding distribution 
assembly (DA). FC 1 powers DA 1, FC 2 powers 
DA 2, and FC 3 powers DA 3. Each distribution 
assembly contains fuses, relays, and remotely 
controlled motor-driven switches called power 
contactors. The DAs control and distribute DC 
power to a corresponding mid power controller 
assembly, forward power controller assembly, 
and aft power controller assembly. 


Ihe FC/MAIN BUS A switch on panel R1 
positioned to ON connects FC 1 to the MN A DA 
1 and controllers and disconnects FC 1 from the 
MN A DA 1 and controllers when positioned to 
OFF. The talkback indicator next to the 
FC/MAIN BUS A switch will indicate ON when 
FC 1 is connected to main bus A distribution 
assembly and controllers, and OFF when FC 1 is 
disconnected from main bus А distribution 
assembly and controllers. The FC/MAIN BUS B 
and C switches and talkback indicators on panel 
R1 function in the same manner. The No. 1 
distribution assembly and all No. 1 controllers go 
with FC 1 and MN A bus, all No. 2 controllers 
and DA 2 go with FC 2 and MN B, and all No. 3 
controllers and DA 3 go with FC3 and MN C. 


Power Controllers 


Power contactors are also located in the aft power 
controller assemblies to control and distribute 
ground-supplied 28-volt DC power to the orbiter 
through the Т-0 umbilical before the FCs take 
over the supply of orbiter DC power. 


Each of the forward, mid, and aft power 
controller assemblies supplies and distributes DC 
power to a corresponding motor controller as- 
sembly and DC power to the orbiter is supplied 
through the Т-0 umbilical before the FCs take 
over the supply of orbiter DC power. 


Each of the forward, mid, and aft power 
controller assemblies supplies and distributes DC 
power to a corresponding motor controller 
assembly and DC power to activate the corre- 
sponding AC power system. 


Aft power controller assemblies 4, 5, and 6 were 
added to accommodate additional electrical loads 
in the aft section. Assemblies 4, 5, and 6 аге 
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powered by FC 1/MN A, FC 2/MN B, and FC 
3/MN C, respectively. 


Remote Power Controllers 


Each power controller assembly contains RPCs 
and relays. The КРСв are solid-state switching 
devices; they have the capability to limit the 
output current to a maximum of 150 percent of 
rated value for 2 to 3 seconds. Within 3 seconds, 
the RPC will trip, removing the output current. 
To restore power to the load, the RPC must be 
reset. This is accomplished by cycling a control 
switch. If multiple control inputs are required 
before a RPC is turned on, hybrid drivers are 
usually used as a logic switch, which then drives 
the control input of the RPC. 


Load Controllers 


Each load controller assembly contains hybrid 
drivers, which are solid-state switching devices 
(no mechanical parts) used as logic switches and 
for low-power electrical loads. When the drivers 
are used as a logic switch, several control inputs 
are required to turn on a load. The hybrid 
drivers are current protected by internal fuses. 
Hybrid relays requiring multiple control inputs 
are used to switch three-phase AC power to 
motors. 


Relays are also used for loads in power controller 
assemblies and motor controller assemblies. 


In the midbody, there are no load controller 
assemblies; therefore, the mid power controller 
assemblies contain remote power controllers, 
relays, and hybrid drivers. 


Motor Controllers 


There are 10 motor controller assemblies used on 
the orbiter: three are in the forward area, four are 
in the midbody area, and three are in the aft area. 
Panel MA73C contains the controls for the motor 
controller assemblies. Their only function is to 
supply AC power to noncontinuous AC loads for 
AC motors used for vent doors, air data probe, 
star tracker doors, payload bay doors, payload 
bay latches, ET doors and latches, RMS deploy 
motors and latches, and reaction control 
system/orbital maneuvering system  motor- 
actuated valves. Each motor controller assembly 
contains main DC buses, AC buses, and hybrid 
relays that are remotely controlled for the 
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application or removal of AC power to АС 
motors. The main DC bus is used only to supply 
control or logic power to the hybrid relays so the 
AC power can be switched on or off. The hybrid 
relays permit major electrical power distribution 
buses to be located close to the major electrical 
loads, which minimizes use of heavy electrical 
feeders to and from the pressurized crew 
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compartment display and control panels. This 
reduces the amount of spacecraft wiring and 
weight, and permits more flexible electrical load 
management. If a main bus is lost, the hybrid 
relays using that main bus will not operate. In 
some cases, the hybrid relays will use logic 
power from a switch instead of the motor 
controller assembly bus. 
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The three forward motor controller assemblies 
(FMC 1, FMC 2, and FMC 3) correspond to MN 
A/AC 1, MN B/AC 2, and MN C/AC 3, 
respectively. Each FMC contains DC power from 
a main bus, ап AC bus, and an RCS AC bus. The 
main bus supplies control or logic power to the 
relays associated with both the AC bus and RCS 
AC bus. The AC bus supplies power to the 
forward left and right vent doors, the star tracker 
Y and Z doors, and the air data left and right 
doors. The RCS AC bus supplies power to the 
forward RCS manifold and tank isolation valves. 


The aft motor controller assemblies (AMC 1, 
AMC 2, and AMC 3) correspond to MN A/AC 1, 
MN B/AC 2, and MN C/AC 3 respectively. 
Each aft motor controller assembly receives 
power from a main bus and its corresponding AC 
bus and a main RCS/OMS bus апа its 
corresponding RCS/OMS AC bus. Both main 
buses are used for control or logic power for the 
hybrid relays. The AC bus is used by the aft 
RCS/OMS manifold and tank isolation and 
crossfeed valves, the aft left and right vent doors, 
and the ET umbilical doors. 


The mid motor controller assemblies (MMC 1, 
MMC 2, MMC 3, and MMC 4) contain two main 
DC buses and two corresponding AC buses. 
MMC 1 contains main bus A and B and their 
corresponding buses, AC 1 and AC 2. MMC 2 
contains MN B and C and AC 2 and AC 3 buses. 
MMC 3 contains the same buses as MMC 1, and 
MMC 4 contains the same buses as MMC 2. 
Loads for the main buses/ac buses are vent doors, 
payload bay doors and latches, radiator panel 
deployment actuator and latches, RMS deploy 
motors and latches, and payload retention latches. 


Component Cooling 


The electrical components in the midbody are 
mounted on cold plates and cooled by the Freon 
coolant loops. The power controller assemblies, 
load controller assemblies, motor controller 
assemblies, and inverters located in forward 
avionics bays 1, 2, and 3 are mounted on cold 
plates and cooled by the water coolant loops. 
The inverter distribution assemblies in forward 
avionics bays 1, 2, and 3 are air-cooled. The load 
controller assemblies, power controller 
assemblies, and motor controller assemblies 
located in the aft avionics bays are mounted on 
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cold plates and cooled by the Freon coolant 
loops. 


Bus Tie 


In the event of an electrical failure, or to load 
share between FCs, any main bus сап be 
connected to another main bus through the use of 
the MN BUS TIE switches on panel КІ and 
power contactors in the distribution assemblies. 
For example, main bus A can be connected to 
main bus B by positioning both the MN BUS TIE 
A and the MN BUS TIE B switch to ON. The 
talkback indicators next to the switches will 
indicate ON when main bus A is connected to 
main bus B. Other indications of an effective bus 
tie are matching voltages for the two buses. To 
disconnect main bus A from main bus B, the MN 
BUS TIE A and B switches must be positioned to 
OFF; the talkback indicators next to the switches 
will then indicate OFF. 


NOTE 


It is also possible to tie the main buses B 
and C together via the PRI switches. This 
is done by connecting each main bus to the 
primary payload bus. This is called a 
"backdoor" bus tie 


Instrumentation and System Monitoring 


Main bus A, B, or C voltages can be displayed on 
the DC VOLTS meter on panel F9 by selecting 
MAIN VOLTS A, B, or C on the rotary switch 
beneath the meter. The МАМ BUS 
UNDERVOLT red caution and warning light on 
panel F7 will be illuminated if main bus A, B, or 
C voltage is 26.4 volts dc, informing the crew that 
the minimum equipment operating voltage limit 
of 24 volts DC is being approached. A BACKUP 
C/W ALARM light will also be illuminated at 26.4 
volts dc. An SM ALERT light will be illuminated 
at 27 volts DC or less, alerting the flight crew to 
the possibility of a future low-voltage problem. 
A fault message also is transmitted to the DPS 
display. 


The nominal FC voltage is 27.5 to 32.5 volts ас, 
and the nominal main bus voltage range is 27 to 
32 volts dc, which corresponds to 12- and 2- 
kilowatt loads respectively. If buses are tied, 
they will indicate the same voltage. 
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The ESS bus voltage can be monitored on the DC 
VOLTS meter on panel F9 by selecting ESS 
VOLTS 1BC, 2CA, 3AB on the rotary switch 
below the meter. An SM ALERT light will be 
illuminated to inform the flight crew if the 
essential bus voltage is less than 25 volts dc. A 
fault message also is shown on the DPS display. 


Each AC bus has a sensor, switch, and circuit 
breaker for flight crew control. The AC 1, 2, and 
3 SNSR circuit breakers located on panel O13 
apply essential bus power to their respective AC 
BUS SNSR 1, 2, 3 switch on panel КІ and 
operational power to the respective INV/AC BUS 
switch and indicator. The AC BUS SENSR 1, 2, 3 
switch selects the mode of operation of the AC 
bus sensor: AUTO TRIP, MONITOR, or OFF. 
The AC bus sensor monitors each AC phase bus 
for over- or undervoltage, and each phase 
inverter for an overload signal. The overvoltage 
limits are bus voltages greater than 123 to 127 
volts AC for 50 to 90 milliseconds. The 
undervoltage limits are bus voltages less than 102 
to 108 volts AC for 6.5 to 8.5 milliseconds. An 
overload occurs when any AC phase current is 
greater than 14.5 amps for 10 to 20 seconds, or is 
greater than 17.3 to 21.1 amps for 4 to 6 seconds. 


When the respective AC BUS SNSR switch is in 
the AUTO TRIP position, and an overload or 
overvoltage condition occurs, the AC bus sensor 
will illuminate the respective yellow AC OVER- 
LOAD or AC VOLTAGE caution and warning 
light on panel F7 and trip off (disconnect) the 
inverter from its respective phase bus for the 
bus/inverter causing the problem. There is only 
one AC VOLTAGE and one AC OVERLOAD 
caution and warning light; as a result, all nine 
inverters/ac phase buses can illuminate the 
lights. The DPS display or the AC VOLTS meter 
and rotary switch beside it on panel F9 would be 
used to determine which inverter or phase bus 
caused the light to illuminate. The phase causing 
the problem would approach 0 amps after the 
bus sensor disconnects the inverter from the bus. 
Because of the various three-phase motors 
throughout the vehicle, there will be an induced 
voltage on the disconnected phase if only one 
phase has loss of power. 
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Before power can be restored to the tripped bus, 
the trip signal to the INV/AC BUS switch must be 
removed by positioning the AC BUS SNSR 
switch to OFF, which extinguishes the caution 
and warning light and resets the bus sensor logic. 
The signal then goes back to the AUTO TRIP 
position. The INV/AC BUS switch is then 
positioned to ON, restoring power to the failed 
bus. 


If there is an undervoltage, the yellow AC 
VOLTAGE caution and warning light on panel F7 
will be illuminated, but the inverter will not be 
disconnected from its phase bus. 


When the AC BUS SENSR 1, 2, 3 switches are in 
the MONITOR position, the AC bus sensor will 
monitor for an overload, overvoltage, and 
undervoltage and illuminate the applicable 
caution and warning light; but it will not trip off 
the phase bus/inverter causing the problem. 


NOTE 


AC BUS SNSR switches are placed in 
MONITOR for ascent to prevent an AC bus 
problem from causing an AUTO-TRIP, 
which could result in the loss of SSME 
controllers on ascent. 


When the AC BUS SNSR switches are OFF, the 
AC bus sensors are non-operational, and ай 
hardware caution and warning and trip-out 
capabilities are inhibited. Тһе BACKUP C/W 
ALARM light will be illuminated for overload or 
over- and undervoltage conditions. A fault 
message also is sent to the DPS display. 
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Orbiter 


Cabin P/L & 
Aux P/L Bus 


Control Power 


APCU 1(2) 


Standard Switch 
Panel 


Output 1(2) CLIOP 


Conv 1(2) tb 


Output 1(2) tb 
28 V DC input 
Primary P/L Bus 


PIL MDM 1(2) 


1(2) Trip Status 


Assembly Power Converter Unit 


OV-104 carries hardware to allow the orbiter to power 
certain payloads at a higher voltage than the orbiter’s 
normal electrical system configuration. The payloads, 
typically ISS-related, operate at 120 volts DC, 
whereas the orbiter operates at 28 volts DC. The 
assembly power converter unit (APCU) is a step-up 
converter controlled via switches on the orbiter flight 
deck (Panel 1.12, also known as Standard Switch 
Panel 1) that consists of two units of two converters 
each. Data is visible to the crew on SM SPEC 200 
APCU STATUS. 


Each APCU contains two converters, both powered on 
or off by the APCU CONV switch on SSP1. Each 
APCU also has an OUTPUT RELAY switch, which 
opens or closes the relay that allows power to be 
transferred downstream. Both switches have 
grey/barberpole talkbacks. OPEN means the relay is 
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APAS, ODS 


and/or ROEU 


= 
m 


Interconnect (dotted line) 
dependent on APCU config 


open and there is no power downstream to the 
payload, while CLOSE sets the relay to allow power 
transfer (thus the switch in the up direction is CLOSE 
and in the down direction is OPEN). The CABIN PL 
1 payload bus provides control power to the APCU 1 
switches through the SW PWR 1 circuit breaker, 
while the AUX PL B payload bus provides control 
power directly to the APCU 2 switches. The talkbacks 
are driven by voltage, so the CONV talkbacks would 
be expected to turn gray when the converters are 
powered on, while the OUTPUT RLY talkbacks would 
be expected to turn gray once the relay is closed. The 
power that gets transformed to 120 volts DC comes 
from the PRI PL bus. 


The APCUs have an interconnected mode such that 
power from one unit may be used to power a payload 
downstream of the other unit. This configuration is 
set on the ground and cannot be changed during 


flight. 
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On SM SPEC 200, the amps and temperature can be 
seen for each of the converters. The voltage is shown 
as high- and low-resolution, but both readings come 
off a single voltage sensor. The trip status will be one 
of 16 discretes ranging from -4.84 to +4.88, each of 
which indicates a particular failure mode of input or 
output overvoltage, undervoltage, overcurrent, or a 
combination of any of them. To find out the exact 
failure mode, a lookup table in the Malfunction book 
must be consulted, but regardless of the failure mode, 
by tripping off, the APCU has been safed. 


XXXX/ XXX/ 200 APCU STATUS ХХ X DDD/HH/MM/SS 
DDD/ HH/ MM/ SS 
APCU 1 APCU 2 
СОМУ А 
OUT AMPS ХХ.Х ХХ.Х 
ТЕМР ХХХ.Х ХХХ.Х 
СОМУ В 
OUT AMPS XX.X XX.X 
TEMP XXX.X XXX.X 
APCU Switches and Talkback Indicators on 
$ OUT VOLTS 
Standard Switch Panel 1 (L12) LOW nee: ЖУ oe 
HIGH RES ХХХ.Х ХХХ.Х 
ТҺІР Х.ХХ Х.ХХ 
SM SPEC 200 APCU STATUS 


Typically, both APCU 1 and АРСИ 2 power 
redundant heaters on ISS hardware carried in the 
payload bay are in non-interconnected mode. They are 
powered by 120 volts DC because that is how the ISS 
power system operates. APCU 2 also powers the 
heaters and sensor packages at the end of the orbiter 
boom sensor system (OBSS). The higher voltage in 
this case is designed to reduce line loss in transferring 
power the length of the remote manipulator system 
(RMS) and OBSS boom itself. 
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Station/Shuttle Power Transfer System (SSPTS) 


OV-103 and ОУ-105 previously carried the 
standalone version of the APCU described above, but 
have been upgraded to the newer Station/Shuttle 
Power Transfer System (SSPTS). Operated via 
switches on panel A15 that were formerly used by the 
EDO Cryo Pallet System (which is no longer used), 
SSPTS consists of two power transfer units (PTUs), 
each of which has a single APCU voltage step-up 
converter similar to the ones discussed above, and two 
voltage step-down orbiter power converter unit 
(OPCU) converters. The OPCU allows 120 volt DC 
power from the ISS solar arrays to be transferred to 
the shuttle’s main buses A and B at 28 volts. The 
OPCU portion of SSPTS offloads some electrical load 
from the orbiter’s FCs onto the ISS solar arrays; the 
reduction in load on the FCs reduces the cryo usage, 
which is then used for mission extension days. The 
APCU portion of SSPTS is usable at any point in the 
mission, while the OPCU portion is only usable after 
docking to the ISS. Data is visible to the crew on SM 
SPEC 179 POWER TRANSFER. 


Before any power can be converted either by an APCU 
or OPCU, the PTUs must be connected to the 
shuttle’s main buses. PTU 1 is associated with main 
A, and PTU 2 is associated with main B. To connect 
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Ше РТИ to the тат bus, Ше CNTL PWR circuit 
breakers on A15 row B must be pushed in first. These 
breakers power the PTU/MAIN BUS switches and 
talkbacks. Upon successful connection between а РТИ 
and main bus, the associated talkback will turn from 
OFF to ON. At this point, an APCU may be 
activated to convert orbiter DC power for payload 
requirements, and, after docking, the OPCU can be 
activated to convert ISS DC power for shuttle main 
bus requirements. 


The SSPTS APCU works similarly to the standalone 
(or “legacy” APCU), except that the SSPTS APCU 
has a single converter per PTU while the legacy 
АРСИ has two converters per unit. The new 
converter is about twice as efficient as the old ones, so 
only one is needed. The SSPTS APCU is controlled 
by a pair of switches, CONV for the converter and 
OUTPUT for the output relay, but neither has 
talkbacks. The APCU 1 and 2 switches are on panel 
А15 rows D and E, respectively. The SSPTS APCU 
outputs also have the capability of being 
interconnected, depending on payload requirements; 
this is changeable only on the ground. 
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Because the OPCUs take input power from the ISS, 
they can only be activated after docking. Each of the 
four OPCU converters receives its power from a 
remote power control module (RPCM) on the ISS, and 
any combination and number of these RPCMs may be 
activated. When an RPCM is activated, power goes 
through the X1/X2 connectors in the docking system 
to the OPCU. For troubleshooting, the crew has two 
ODS MATE switches on А15 (row C) that test the 
X1/X2 connectors for continuity. 


Once the RPCM is activated on the ISS, the OPCU 
volts and temperature sensors on the shuttle are 
powered and the data changes from off-scale low to a 
valid reading. The crew can use this as a method of 
verifying that the ISS RPCMs have been activated. 


To convert ISS power, the SSPTS OPCU converters 
are activated via switches on panel A15. Initially, the 
OPCU output voltage is 31.12 volts DC, generally 
slightly lower than the main bus voltage, but by 
increasing the output voltage above the level of the 
main buses, the OPCUs will draw loads away from 
the mains. This voltage adjust is accomplished either 
by the crew or Mission Control. If the V-ADJ voltage 
adjust switch is in PNL, the crew can manually adjust 
the voltage up or down in increments of 0.04 volts per 
switch movement, and if the switch is in CMD, 
Mission Control will send real-time commands 
(RTCs) to adjust the voltage. The OPCUs are 
hardware limited to output 31.80 volts, and 
maximizing OPCU output volts minimizes FC loads. 
However, depending on the loads, the OPCUs may go 
into input-current-limiting mode; when it reaches its 
maximum output power, it automatically drops the 
output voltage and allows the FC to pick up additional 
loads. 


Since the OPCUs only take power from main buses A 
and B, main C tends to pick up some of the dioded 
loads and carry more of the load. To even out the loads 
among the three main buses, Mission Control may opt 
to perform a bus tie to main C to evenly distribute the 
dioded loads. 
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SSPTS Switches and Talkback Indicators on 
Panel A15 


At the top of SPEC 179 are fields for fuel cell power 
(displayed here individually, while on SYS SUM 1 the 
total power is displayed), main bus volts, and the 
status of the PTU/main bus connection (ON or OFF). 
Although only two FC/main buses are used in SSPTS, 
the third is shown here for completeness. A field next 
to the main bus letter will read " — ТТЕ” when that 
bus is tied, using the same telemetry signal that drives 


XXXX/XXX/179 POWER TRANSFER хх X DDD/HHIMM1SS 
1 1 


FC POWER (KW) XX.XS 
MAIN VOLTS XX.XXS 
PTU/MAIN BUS 


PTU 1 

ОРСУ А в 
OUT VOLTS XX.XXS хх,хх5 XX.XXS 
AMPS XX.XS хх.х5 XX.XS 


XX 
XXX XX 


хх 
ххх хх 


хх 
ххх хх 


the bus Не talkback on panel КЛ. 


SM SPEC 179 POWER TRANSFER 


OPCU data on SPEC 179 is divided by PTU and then 
by converter. Each of the four converters has output 
volts, output amps, temperature, and various trip 
statuses. As mentioned previously, output volts and 
temperature will be off-scale low until the ISS RPCMs 
provide input “housekeeping” power. The trip status 
fields are blank until the converter has tripped, and 
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show іп text format the reason for the trip (e.g., IN 
OC for input overcurrent and OUT OV for output 
overvolt). 


APCU data on SPEC 179 is similar to that seen on 
the legacy display. The crew can see APCU output 
volts, input and output amps, temperature, output 
relay status (ON or OFF), and trip status. The 
output status replaces the need for a talkback on the 
panel, and the trip status as a numeric discrete has 
been replaced by text on the display (such as IN UV 
for input undervolt, OUT OC for output overcurrent, 
etc.). The trip status on the display is blank unless 
invoked. 


The SSPTS APCUs are used for the same purposes as 
their standalone predecessor; they power heaters on 
ISS hardware carried in the payload bay, while APCU 
2 also powers the heaters and sensor packages at the 
end of the OBSS. 


Operations 


Prelaunch 


During prelaunch operations, the onboard FC 
reactants (oxygen and hydrogen) are supplied by 
ground support equipment to assure a full load 
of onboard reactants before lift-off. At T minus 2 
minutes 35 seconds, the ground support 
equipment filling operation is terminated. The 
ground support equipment supplies hydrogen 
and oxygen to the PRSD manifold at pressures 
greater than the tank heater control range 
pressures (approximately 280 psia for hydrogen 
and 960 psia for oxygen). This helps to prevent 
cryo tank heater cycling during powered flight. 
The ground support equipment supply valves 
close automatically to transfer to onboard 
reactants. 


The FCs will be on when the crew boards the 
vehicle. Until T minus 50 seconds, power to the 
orbiter is load shared between the FCs and 
ground support equipment, even though the FCs 
are on and capable of supplying power. Main 
bus power 18 supplied through the 1-0 
umbilicals, MN A through the left-side umbilical 
and MN B and C through the right-side umbilical 
to aft power controllers (APCs) 4, 5, and 6. From 
APCs 4, 5, and 6, the ground support equipment 
power is directed to the distribution assembly 
where the power is distributed throughout the 
vehicle. The power for the PREFLT 1 and 
PREFLT 2 test buses is also supplied through the 
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T-0 umbilical. These test buses are scattered 
throughout the orbiter and are used to support 
launch processing system control of critical 
orbiter loads, although they also power up the 
essential buses in the APCs when on ground 
support equipment. As in the main bus 
distribution, essential bus power from the APCs 
is directed to the distribution assemblies and then 
distributed throughout the vehicle. At T minus 
50 seconds, the ground turns off the ground 
support equipment power to the main buses, and 
the FCs automatically pick up the remaining 
vehicle electrical loads. 


Indication of the switchover can be noted on the 
DPS display and the DC AMPS meter. The FC 
current will increase to approximately 220 amps; 
the oxygen and hydrogen flow will increase to 
approximately 4.6 and 0.6 pound per hour 
respectively; and the FC stack temperature will 
increase slightly. At T minus zero, the T-0 
umbilical is disconnected with the preflight test 
bus wires live. 


Prelaunch and On-Orbit Tank Heater 
Management 


Before lift-off, the O2 TK1 HEATERS A, O2 TK2 
HEATERS A, H2 TK1 HEATERS A, and H2 TK 2 
HEATERS A switches on panel К1 are set оп 
AUTO. As part of the Post OMS 1 Burn proce- 
dures, all the switches on O2 and H2 tanks 1 & 2 
are positioned to AUTO, while the other tank 
heaters remain OFF. On orbit, the cryo tank 
heaters are managed to provide for tank quantity 
balancing. Tanks 3, 4, and 5 will supply reactants 
to the FCs instead of tanks 1 and 2 when all the 
tank heaters are set to AUTO. This is because the 
heater controllers in tanks 3, 4, and 5 control to a 
higher pressure than tanks 1 and 2. For entry, 
tanks 1 and 2 supply the reactants to the FCs. 


Fuel Cell Operating Modes 


FC standby consists of removing the electrical 
loads from a FC but continuing operation of the 
FC pumps, controls, instrumentation, and valves, 
while electrical power is supplied by the 
remaining FCs. A small amount of reactants is 
used to generate power for the FC internal 
heaters. If the temperature in the FC 
compartment beneath the payload bay is lower 
than 40° F, the FC should be left in STANDBY 
instead of being shut down to prevent it from 
freezing. 
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FC shutdown, after standby, consists of stopping 
the coolant pump and hydrogen pump/water 
separator by positioning that FUEL CELL 
START/STOP switch on panel R1 to the STOP 
position. 


FC safing consists of closing the FC reactant 
valves and consuming the reactants inside the FC 
by either leaving the FC connected to its main 
bus or by keeping the pump package operating 
with the internal heaters. 
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EPS Caution and Warning Summary 


® The SM ALERT will illuminate if a cryo 


heater current level sensor detects a short on 
a heater circuit. 


The yellow Oz PRESS and the red BACKUP 
C/W ALARM lights illuminate if oxygen 
tank pressure is below 540 psia or above 985 
psia. 


The yellow Н; PRESS and the red BACKUP 
G/W ALARM lights illuminate if hydrogen 
tank pressure is below 153 psia or above 
293.8 psia. 


When any FC reactant valve is closed, the red 
FUEL CELL REAC light is illuminated, a tone 
is sounded and the BACKUP CW ALARM is 
illuminated. 


The yellow FUEL CELL STACK TEMP light 
will illuminate if FC and stack temperatures 
are below 170.79 Е or above 241.9° Е. The red 
BACKUP C/W ALARM and blue SM ALERT 
will also light for similar limits. 


The yellow FUEL CELL PUMP light will 
illuminate if FC 1, 2, or 3 coolant pump delta 
pressure is lost. If the coolant pump for FC 1, 
2, or З is off, the BACKUP CW ALARM will 
be illuminated. 


The yellow O2 HEATER TEMP light on panel 
F7 illuminates if the temperature sensor 
senses the oxygen tank temperature is at or 
above 344° F. Software checks the limit; if it 
is above 349°F, the BACKUP C/W ALARM 
light illuminates as well. 


The red MAIN BUS UNDERVOLT light and 
the BACKUP CW ALARM illuminate if main 
bus A, B, or C voltage is 26.4 volts dc. 


The yellow AC VOLTAGE light illuminates 
for an overvoltage or undervoltage condition 
in the AC bus. The red ВАСКИР СЛУ 
ALARM will also illuminate. 


The yellow AC OVERLOAD light illuminates 
for an overload condition in the AC bus. 


FUEL CELL FUEL CELL FUEL CELL 
02 PRESS | HS PRESS REAC STACK TEMP PUMP 
| | (8 | | 
CABIN АТМ 2703: MAIN BUS AC АС 
(8 ТЕМР UNDERVOLT VOLTAGE OVERLOAD 
FREON AV ВАҮ/ 
эрмэг: | 2016 IMU | FWD RCS RCS JET 
H2O LOOP | RGA/ACCEL| AIR DATA LEFTRCS | RIGHTRCS 
| GE | Ө 
| LEFT RHC RIGHT/AFT | |ЕЕТОМ5 | RIGHT OMS 
(В | | 
PAYLOAD ЕС5 (В 
WARNIN (у ere NM ОМ ЕТ Өмә ыг 
PAYLOAD 
CAUTION | PRIMARY CW ci ANNEL MPS R 
BACKUP C/W APU APU 
ALARM (R) TEMP OVERSPEED| UNDERSPEED HYD PRESS 
346.cvs 
EPS Caution and Warning Lights on Panel F7 
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— 0001/ /079 SM SYS SUMM 2 5 008/23:29:22 
0001/  /078 SM SYS SUMM 1 M 000/03:13:09 BES 006/88: G8: do 
2/B, DC VOLTS 1/А 2/B 3/C CRYO ТК 1 2 3 4 5 MANF1 MANF2 
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ВЕ === T2 -248 -248 -248 -248 -248 
CNTL 29.3 29.3 29.3 APU 1 2 3 НҮр 1 2 3 


29.3 “00.04 29.3 
29.3 29.3 29.3 


TEMP EGT 942 942 942 |PRESS 3064 3064 3064 
B/U EGT 942 942 942 | ACUM P 3080 3080 3080 
OIL IN 250 250 250 | RSVR T 116 153 142 

OUT 264 264 264 
GG BED 511H 511Н 511Н 0ТҮ 72 74 71 


АС 
VOLT 117 117 117 
117 117 117 
117 117 117 


HX олт 49 AMPS 4.4 4.1 2.7 INJ 1271 1271 1271 

02 FLOW 0.0 6.0 В 3.9 4.2 3.2 SPEED % 99 102 101| W/B 
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К 15 * TEMP 97 97 83 |EVAP OUT T 38 38 
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EPS Summary Data 
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The EPS operates during all flight phases 
and consists of the equipment and reactants 
that produce electrical power for 
distribution throughout the orbiter. 


The FC picks up full power load support 
after ground equipment is turned off at 
T minus 50 seconds, supporting power 
requirements for the solid rocket booster, 
orbiter, and payloads. 


EPS subsystems are: power reactants 
storage and distribution, FCs, and electrical 
power distribution and control. 


The Power  Reactants Storage and 
Distribution system stores cryogenic 
hydrogen and oxygen and supplies them to 
the FCs. It also supplies oxygen to the 
ECLSS. The components are located in the 
orbiter midbody underneath the payload 
bay. 


The FC system (three FCs) transforms 
hydrogen and oxygen to electricity by a 
chemical reaction. The system supplies 
potable water to the ECLSS and consists of 
power and accessory sections. 


The electrical power distribution and 
control system distributes electrical power 
throughout the orbiter. It has five types of 
assemblies: power control, load control, 
motor control, main DC distribution, and 
AC distribution and control. 


The EPS requires very little flight crew 
interaction during nominal operations. 


The majority of the EPS controls are on 
panels К1 and R11U. Power sources and 
circuit breakers are distributed on panels 
O13, O14, O15, O16, ML86B, R14, A15, and 
MAZ73C. Heaters are controlled from panel 
R1, A11, and A15. 


Meters for monitoring EPS parameters are 
located on panels F9 and O2 


DPS displays containing EPS data are BFS 
SM SYS SUMM 1 and 2, PASS SM SYS 
SUMM 1 and 2, SM SPEC 67 (ELECTRIC), 
SM SPEC 68 (CRYO SYSTEM), SM SPEC 69 
(FUEL CELLS) SM SPEC 179 (POWER 
TRANSFER), and SM SPEC 200 (АРСИ 
STATUS). 
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Never close a circuit breaker or reset an 
RPC found out of configuration without 
MCC coordination. 


Loss of cooling to a FC requires crew action 
within 9 minutes to prevent a catastrophic 
loss of crew/ vehicle due to possible FC fire 
and explosion. 


FC run limit prior to shutdown for loss of 
cooling is 9 minutes at a 7 KW nominal load. 
Run time is inversely proportional to FC 
load. 


Any interruption of continuous AC power 
during ascent will result in the loss of main 
engine controller redundancy. Reconfig- 
uration of AC powered equipment prior to 
MECO should be avoided. 


Never connect or reconnect power to a 
known shorted or failed component; this 
includes switch throws, circuit protection 
device resets, or bus ties. 


Three oxygen and hydrogen tanks are good 
for up to 8 days on orbit; five oxygen and 
hydrogen tanks are good for up to 12 days 
on orbit; eight oxygen and hydrogen tanks 
are good for up to 18 days on orbit. Exact 
duration varies with crew complement and 
power load. 


A FC hydrogen pump uses 0.3 amps/ AC 
phase; a coolant pump uses 0.5 amps/ AC 
phase. 
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Description 


The ECLSS maintains the orbiter’s thermal 
stability and provides a pressurized, habitable 
environment for the crew and onboard avionics. 
The ECLSS also manages the storage and 
disposal of water and crew waste. 


ECLSS is functionally divided into four systems: 


1 Water coolant loops 17 
2 Interchanger heat exchanger 18 Water pumps 
3 Payload heat exchanger 19 
4 Freon-21 coolant loops 20 
5 Fuel cell power plants 21 
6 Cargo heat exchanger 22 
7 Hydraulic heat exchangers 23 


to radiators 

Aft avionics bay and cold plates 
Ground support equipment 
heat exchanger 

Flash evaporators 
Ammonia boiler 

To radiators 

Midbody cold plates 

Fuel cell heat exchanger to 
Freon-21 coolant loops 
Freon-21 coolant pumps 
Avionics bays 1, 2, and 

3A heat exchangers, 

fans, and coolant plants 


оо 


10 
11 
12 
13 
14 


15 
16 
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Inertial measurement units heat exchanger and fans 


Cabin air to water heat exchanger 
Humidity water separators 
Carbon dioxide absorber 

Cabin fans and check valve assemblies 
Liquid-cooled garment heat exchanger 
Potable water chiller heat exchanger 
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Pressure control system (PCS) 
maintains the crew compartment at 14.7 
psia with a breathable mixture of oxygen 
and nitrogen. Nitrogen is also used to 
pressurize the supply and waste water 
tanks. 


Atmospheric revitalization system, 
(ARS) uses air circulation and water 
coolant loops to remove heat, control 
humidity, and clean and purify cabin air. 


Active thermal control system (ATCS) 
consists of two Freon loops that collect 
waste heat from orbiter systems and 
transfer the heat overboard. 


Supply and waste water system stores 
water produced by the fuel cells for 
drinking, personal hygiene, orbiter 
cooling, and eventual transfer to the 
International Space Station (ISS). The 
waste water system stores crew liquid 
waste and waste water from the 
humidity separator. The system also has 
the capability to dump supply and waste 
water overboard. 
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2.9 Environmental Control and Life Support System 


Тһе crew compartment provides а life-sustain- 
ing environment for the flight crew. The cabin 
volume is 2,475 cubic feet. For extravehicular 
activity (EVA), an external airlock 15 
depressurized апа repressurized. Under 
normal circumstances, the cabin may be 
depressed to 10.2 psia to ease prebreathe 
requirements prior to an EVA. The airlock is 
outside the middeck in the payload bay and 
brings the combined cabin volume to 
approximately 2,703 cubic feet. The external 
airlock volume varies and is based on mission- 
specific configuration. The external airlock is 
covered in detail in the Orbiter Docking System 
(ODS) section of this document. 


Most ECLSS parameters can be monitored 
during ascent and entry оп BFS DISP 78 (SM SYS 
SUMM 1) and BFS DISP 79 (SM SYS SUMM 2) 
displays. On orbit ECLSS parameters are also 
available on SM DISP 66 (ENVIRONMENT) and 
SM DISP 88 (APU/ENVIRON THERM) displays. 
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ECLSS Parameters on the ВЕб SM SYS 
SUMM 1 Display (DISP 78) 
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ECLSS Parameters on the BFS SM 
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Pressure Control System 


Pressure Control System 


Ihe pressure control system normally 
pressurizes the crew cabin to 14.7 + 0.2 psia. It 
maintains the cabin at an average 80-percent 
nitrogen (130 pounds) and 20-percent oxygen 
(40 pounds) mixture that closely resembles the 
atmosphere at sea level on Earth. The system 
also provides the cabin atmosphere necessary to 
cool cabin-air-cooled equipment. Oxygen par- 
tial pressure is maintained automatically 
between 2.95 and 3.45 psi, with sufficient 
nitrogen pressure of 11.5 psia added to achieve 
the cabin total pressure of 14.7 + 0.2 psia. 
Positive and negative pressure relief valves 
protect the structural integrity of the cabin from 
over- and underpressurization, respectively. 
The pressure control system nitrogen is used to 
pressurize the supply and waste water tanks. 
The system also provides breathing oxygen 
directly to the launch and entry suit helmets 
and to emergency breathing masks. 


Cabin pressure is maintained by either of two 
pressure control systems (designated PCS 1 and 
PCS 2). Each PCS consists of a liquid oxygen 
storage system and a gaseous nitrogen storage 
system. The PCS oxygen is supplied from the 
electrical power system’s (EPS) cryogenic 
oxygen in the midfuselage of the orbiter. The 
cryogenic supercritical oxygen storage system is 
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controlled by electrical heaters within the tanks 
and supplies oxygen to the ECLSS pressure 
control system at a pressure of 803 to 883 psia in | 
a gaseous state. The nitrogen storage tanks are 
serviced to a nominal pressure of 2,964 psia at 
80° F. Normal on-orbit operations use one 
oxygen and one nitrogen supply system. 


Cabin pressure is controlled by the nitrogen/ 
oxygen control and supply panels, an associated 
РРО» sensor, and the pressure relief valves. Тһе 
nitrogen/ oxygen control panel regulates PCS 1 
and PCS 2 oxygen and nitrogen. Typically, PCS 
1is activated for the first half of the mission and 
PCS 2 is activated for the second half. System 1 
and system 2 nitrogen/oxygen supply panels 
are located in the middeck (panel MO10W) and 
the forward flight deck (panel L2). Both О» and 
№ supply systems 1 and 2 have a crossover 
capability, which allows the respective systems 
to be tied together. 


Тһе oxygen supply system provides the 
makeup cabin oxygen for flight crew 
consumption and makeup for normal cabin 
leakage. The nitrogen system provides nitrogen 
for pressurizing the cabin and the supply and 
waste water tanks. Each crew member uses an 
average of 1.76 pounds of oxygen per day. 
About 6 pounds of nitrogen and 14 pounds of | 
oxygen are used per day for normal loss of crew 


2.9-4 


2.9 Environmental Control апа Life Support System 


USA007587 


Rev. A 
АТМ PRESS CONTROL 
П 515 1—— 
ша. ШІ неш © [— YAW TRIM — 
ти $c 
г 02/ N2 EU МУ = 
© a 
ОР Ер AUTO 
m 1515) РРО2 Еи 
Хо бой , CLOSE 
mE SYS 2 [2] 
о = 
Q 
ATM PRESS CONTROL 02 SYS SUPPLY and 
XOVR Switches and Talkbacks on Panel L2 
cabin gas to space and metabolic usage for a positioned to CLOSE, the valve is closed, 
typical seven-member crew. The supply and waste isolating that oxygen supply system. The 


water tanks are pressurized to 17 psig to expel 
water from the tanks for use by the crew, for 
dumping overboard, or for supplying water at the 
appropriate pressure for use by the flash evaporator 
system (FES). 


Oxygen System 


Oxygen from the power reactant storage and 
distribution system (cryogenic oxygen supply 
system) is routed to the pressure control oxygen 
system 1 and system 2 supply valves. These 
valves are controlled by the ATM PRESS 
CONTROL O2 SYS 1 SUPPLY and O2 SYS 2 
SUPPLY switches on panel L2. When one of the 
switches is momentarily positioned to OPEN, the 
corresponding valve opens to permit oxygen to 
flow through an oxygen restrictor at a maximum 
flow of approximately 25 pounds per hour for 
either system 1 or 2. The oxygen restrictor also 
functions as a heat exchanger with the Freon 
coolant loop, warming the oxygen supplied to 
the oxygen regulator of that system before it 
flows into the cabin. Freon loop 1 warms system 
1 oxygen, and loop 2 warms system 2. A 
talkback indicates OP when the О» supply valve 
is open. When the switch is momentarily 


2.9-5 


talkback indicates CL. 


Next, the oxygen piping penetrates the 
bulkhead and enters the crew compartment. A 
check valve downstream of the О2 flow 
restrictor prevents oxygen from flowing from 
one supply source to the other when the 
crossover valves are open. Downstream of the 
oxygen check valve, oxygen systems 1 and 2 are 
connected by a crossover valve that permits 
system 1 and system 2 to be interconnected. The 
crossover valves are controlled by the ATM 
PRESS CONTROL O2 XOVR SYS 1 and SYS 2 
switches on panel L2. When one of the switches 
is positioned to OPEN, the associated oxygen 
supply system is directed to the launch and 
entry helmet О» supply 1 and 2 manual valves, 
airlock oxygen 1 and 2 extravehicular mobility 
unit, and direct О. If both switches are 
positioned to OPEN, oxygen supply systems 1 
and 2 are interconnected. When a switch is 
positioned to CLOSE, that oxygen supply 
system is isolated from the crossover feature. 
The crossover valves are normally open. 
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Oxygen System 


Downstream of the oxygen crossover line is an 
oxygen regulator inlet manual valve. When the 
valve is manually positioned to OPEN by the О; 
REG INLET switch on panel MO10W, oxygen is 
directed to a regulator that reduces the oxygen 
supply pressure to 100 + 10 psig. Each 
regulator valve has а manual toggle 
OPEN/CLOSE valve, a regulator, and a relief 
valve. The relief valve relieves pressure at 245 
psig and reseats at 215 psig. The relief pressure 
is vented into the crew cabin. The regulated O2 
then passes through another check valve that 
prevents downstream nitrogen from entering the 
oxygen system. The oxygen enters a manifold 
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that is shared by the nitrogen system. This | 
manifold is connected to its 14.7 psi cabin 
regulator inlet manual valve and the 8 psi 
regulator. Between the oxygen regulator and the 
oxygen check valve, the oxygen is fed to the 
payload oxygen manual valve for use by the 
payload, if needed. This valve, as well as the 14.7 
cabin pressure manual valve, is located on panel 
MOI10W. Makeup О» for metabolic usage is 
provided by a bleed orifice inserted on orbit into 
LEH C2 8 quick disconnect on panel MO69M. 
The bleed orifice is sized to supply 0.24 pounds-mass 
per hour (Ibm/hr) of O» for four- to five-member crews 
and 0.36 lbm/hr for six- to seven-member crews. 
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Gaseous nitrogen is supplied from two nitrogen 
systems, consisting of either two or three 
nitrogen tanks (depending on orbiter) per 
system that are mounted in the payload bay. 
System 1 is mounted on the port side and 
system 2 is on the starboard side. OV-103 and 
OV-105 each have а standard  six-tank 
configuration, while OV-104 is currently equipped 
with five nitrogen tanks (two in System 1 and three 
in System 2). On each of the vehicles, additional 
tanks may be flown as mission kits. 


Note: The N2 tank configuration and number 
of tanks flown may vary by flight, based on 
mission requirements. 


The nitrogen supply tanks are constructed of 
filament-wound Kevlar fiber with a titanium 
liner. Each nitrogen tank is serviced to a 
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nominal pressure of 2,964 psia at 80° F, with a 
volume of 8,181 cubic inches. The nitrogen 
tanks in each system are manifolded together. 


The PCS 1 and PCS 2 nitrogen supply systems 
are controlled by the atmosphere pressure 
control nitrogen supply valves in each system. 
Each valve is controlled by its corresponding 
ATM PRESS CONTROL N2 SYS 1 and SYS 2 
SUPPLY switch on panel L2. When a switch is 
momentarily positioned to OPEN, nitrogen 
flows to both atmosphere pressure control 
system regulator inlet valves, since both sets of 
tanks are manifolded together downstream of 
the supply valve. A talkback near the switch 
indicates barberpole when the motor-operated 
valve is in transit, and OP when the supply 
valve is open. When the switch is positioned to 
CLOSE, that nitrogen supply system is isolated 
from the nitrogen system regulator inlet valve, 
and the talkback indicator shows CL. 
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REG INLET Switches and Talkbacks on Panel L2 


The nitrogen regulator inlet valve in each 
nitrogen system is controlled by its respective 
ATM PRESS CONTROL № SYS REG INLET 
switch on panel L2. When the switch is 
positioned to OPEN, that system’s nitrogen at 
source pressure is directed to the system’s 
nitrogen regulator. A talkback indicator below 
the SYS 1 switch and above the SYS 2 switch 
indicates barberpole when the motor-operated 
valve is in transit, and OP when the valve is 
open. When the switch is positioned to CLOSE, 
the supplied nitrogen is isolated from the 
system’s nitrogen regulator, and the talkback 
indicator indicates CL. 


The nitrogen regulators in supply systems 1 and 
2 reduce the pressure to 200 + 15 psig. Each 
nitrogen regulator is a two-stage regulator with 
a relief valve. The relief valve relieves pressure 
at 295 psig into the vacuum vent line and 
reseats at 245 psig. 
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The pressure regulated nitrogen of each system 
then enters the crew cabin and encounters a check 
valve to prevent backflow from one nitrogen source 
supply to the other if the nitrogen crossover is open. 
This check valve also prevents flow from the pressure 
control system out of the crew cabin in the event of 
an upstream plumbing leak. Past the check valve, 
each system’s regulated nitrogen is directed to the 
nitrogen manual crossover valve, the manual 
water tank regulator inlet valve, the payload 
manual nitrogen supply valve, and the oxygen 
and nitrogen controller valve in each system. 
Each system can supply nitrogen at a rate of at least 
125 lbm/hr. The manual valves are controlled 
from panel MO10W, and the controller valve is 
controlled from the panel L2 02/32 CNTLR 
VLV switch. 


The nitrogen crossover manual valve connects 
both regulated nitrogen systems when the valve 
is open and isolates the nitrogen supply systems 
from each other when closed. Normally, the 
valve is always closed. 


2. SYSTEMS 


2.9 Environmental Control and Life Support System 


USA007587 
Rev. A 


Oxygen/Nitrogen Manifold 


The O»/N» control valve controls the flow of 
either № ог О; into the O»/N» manifold, 
depending on the partial pressure of oxygen in 
the cabin. Whatever gas (0:/ №) is in the 
O2/N2 manifold will flow into the cabin when 
the cabin pressure drops below 14.7 psia, and 
the 14.7 regulator inlet valve is open. This flow 
will continue as long as the cabin pressure is 
less than 14.7. An 8 psia emergency regulator 
provides flow to maintain a cabin pressure of 8 
psia in the event of a large cabin leak. There is 
no regulator inlet valve to isolate the 8 psia 
emergency regulator; therefore, it is always 
configured to provide flow. 


The 14.7 psi cabin regulator regulates the cabin 
pressure to 14.7 + 0.2 psia and is capable of a 
maximum flow of 75 to 125 lb/hr. The 8 psi 
emergency regulator regulates to 8 + 0.2 psia 
and is also capable of a maximum flow of 75 to 
125 lb/hr. Both the 14.7 and 8 psi regulators 
flow into the cabin through a port in panel 
MO10W located above the waste management 
system compartment. Regulators consist of two 
stages: a low-flow regulator (0 to 0.75 Ib/hr) for 
small demand when the cabin pressure is near 
14.7 psia and a high flow regulator (0.75 to at 
least 75 lb/hr) for high demand when cabin 
pressure is significantly below 14.7 psia. 


NOTE 


Crewmembers should be aware that the 
regulators make a noticeable sound when 
they flow oxygen or nitrogen into the 
cabin. It is most noticeable in the vicinity 
of the waste management system com- 
partment. Additionally, use of the waste 
control system (WCS) during high № 
flow is not advisable due to the 
possibility of hypoxia. 


РРО: Control 


The partial pressure of oxygen (РРО;) in the 
crew cabin can be controlled automatically 
during orbit by one of two O»/N» controllers. 
Two PPO» sensors (A and B) located under the 
mission specialist station provide inputs to the 
PPO» control systems 1 and 2 controller and 
switches, respectively. When the ОУМ› CNTLR 
VLV switch on panel L2 is positioned to AUTO in a 
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given pressure control system, the actual position of 
the valve (OPEN, to flow nitrogen or CLOSE, to 
inhibit nitrogen flow and allow oxygen to flow into 
the Ox/N2 manifold) is governed by the associated ОЈЛ 
controller. If the PPO2 SNSR/VLV switch on panel 
L2 is in the NORM position, O2/N2 Controller 1 
controls the position of the OyN» CNTLR УГУ in 
pressure control system 1 and OyN» Controller 2 
controls the position of the OyN» CNTLR VLV in 
pressure control system 2. These associations are 


reversed if the PPO2 SNSR/VLV switch is in the 
REVERSE position. 


PPO2 SNSR/VLV and OyN; CNTRL УТУ 
Switches on Panel L2 
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2.9 Environmental Control апа Life Support System 


When the РРО; sensor and O2/N2 controller 
associated with the ОУМ» control valve that is in the 
AUTO position detects low oxygen levels in the crew 
cabin, the O2/N2 control valve is automatically 
closed. When the 200-psi nitrogen in the О 
manifold drops below 100 psi, the 
corresponding oxygen system flows oxygen 
through its check valve into the manifold and 
through the 14.7 psi cabin regulator into the 
crew cabin. When the РРО» sensor and OyN» 
controller determine that the oxygen in the crew 
cabin is at the upper end of its allowed control 
range, the corresponding O»/ № control valve is 
automatically opened. The 200-psi nitrogen 
enters the O;/N» manifold and forces the 
corresponding oxygen system's check valve 
closed and flows through the 14.7 psi regulator 
into the crew cabin whenever the cabin pressure 
drops below 14.7 psia + 0.2. Тһе OPEN and 
CLOSE positions of the OyN» CNTLR УГУ SYS 
1 and SYS 2 switches on panel L2 permit the 
flight crew to manually control the О›/ № valve 
in each system and manually switch between O2 
and N» systems. 


The SYS 1 and SYS 2 РРО, CNTLR switches 
were designed to control the РРОЬ, level (via the 
O»/ N» CNTLR) of the cabin between the normal 
range (2.95-3.45 at 14.7 psi) and the emergency 
range (1.95-2.45 at 8 psi). The control range can 
be determined by positioning the switch in 
NORM or EMER. The EMER position is 
procedurally never used. 


The flow rates of oxygen systems 1 and 2 and 
nitrogen systems 1 and 2 can be monitored via 
the О›/ №» FLOW meter on panel O1 and on the 
SM SYS SUMM 1 (DISP 78, both BFS and PASS) 
and SM ENVIRONMENT (DISP 66, PASS only) 
displays. Тһе flow of the selected system 15 
displayed on the meter and CRT displays in 
pounds per hour. The currently used flow sensors 
go off-scale low (OSL) at 0 Ibm/hr flow and off-scale 
high (OSH) at 5 lbm/hr, and high flow alarms 
annunciate at 4.9 lbm/hr. То replace a set of failed 
sensors, new flow sensors are being incorporated into 
OV-104 that are capable of measuring flow up to 
25 тућт. However, these sensors are nonlinear, so 
they will report a maximum flow rate onboard of 
12.4 Ibm/hr. Calibration for these sensors has been 
specified to also annunciate a high flow alarm at 
4.9 lbm/hr (actual and displayed), just like the 
currently used flow sensors. PPO» sensors A and 
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B monitor the oxygen partial pressure and the 
signal to the SENSOR switch on panel О1. 
When the switch is positioned to SENSOR A, 
oxygen partial pressure from sensor А 15 
monitored on the РРО» meter on panel O1 іп 
psia. If the switch is set on SENSOR B, oxygen 
partial pressure from sensor B is monitored. 
The cabin pressure sensor output is routed 
directly to the CABIN PRESS meter on panel O1 
and is displayed in psia. These parameters can 
also be viewed on DPS displays SM SYS SUMM 
1 (PPO2) and DISP 66, ENVIRONMENT (PPO2 
A, B, C). 


(dP/dT) decreases at a rate of 0.08 psi per 
minute or more, a klaxon will sound in the crew 
cabin, and the MASTER ALARM pushbutton 
light indicators will be illuminated. Normal 
cabin dP/dT is zero psi per minute +0.01 psi. 


If the change in pressure versus change in time | 
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Meters and Switches on Panel О1 
(Transducers also supply information for SM 
SYS SUMM 1, DISP 66, and C/W.) 
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The SM SYS SUMM 1 display is an SM 
display (DISP78) available in SM OPS 2 
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The ENVIRONMENT display is an SM 
display (DISP 66) available in SM OPS 2 
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CABIN RELIEF and CABIN VENT Switches 
and Talkbacks on Panel L2 


Cabin Relief Valves 


Two positive pressure relief valves are in paral- 
lel to provide overpressurization protection of 
the crew module cabin above 15.5 psid. The 
valves will crack at 15.5 psid, reach full flow by 
16.0 psid, and reseat again below 15.5 psid. 
Each cabin relief valve is controlled by its 
corresponding CABIN RELIEF switch on panel 
L2. When the switch is positioned to ENABLE, 
the motor-operated valve opens, exposing cabin 
pressure to a corresponding positive pressure 
relief valve. The relief valve maximum flow 
capability is 150 pounds per hour at 16.0 psid. 
A talkback indicator above the switch indicates 
barberpole when the motor-operated valve is in 
transit, and ENA when the motor-operated 
valve is open. When the switch is positioned to 
CLOSE, the corresponding motor-operated 
valve isolates cabin pressure from the relief 
valve and the talkback indicator indicates CL. 


Vent Isolation and Vent Valves 


The cabin vent isolation valve and cabin vent 
valve are in series to vent the crew cabin to 
ambient pressure while the orbiter is on the 
ground. Approximately 1 hour 30 minutes 
before lift-off, the cabin is pressurized to 
approximately 16.7 psi for leak checks. Cabin 
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pressure is then monitored for 35 minutes to 
verify that no pressure decay occurs. During 
this time, the cabin vent and cabin vent isolation 
valves are alternately opened and closed to 
verify that each holds pressure. 


The cabin vent isolation valve is controlled by 
the VENT ISOL switch on panel L2, and the 
cabin vent valve is controlled by the VENT 
switch. Each switch is positioned to OPEN to 
control its respective motor-operated valve. 
When both valves are open, the cabin pressure 
is vented into the mid-fuselage. The maximum 
flow capability through the valves at 2.0 psid is 
1080 pounds per hour. 


A talkback indicator above each switch indicates 
the position of the respective valve: CL when the 
valve is closed, barberpole when the valve is in 
transit, and OP when it is open. 


WARNING 
Because of the high flow capability of the 


cabin vent isolation valves, these valves 
should never be opened after lift-off. 


Negative Pressure Relief Valves 


If the crew cabin pressure is lower than the 
pressure outside the cabin (e.g., during the final 
stages of entry following a cabin leak), two negative 
pressure relief valves in parallel will open at 0.2 
psid, permitting flow of ambient pressure into 
the cabin. Caps over each valve provide a 
positive pressure seal and will pop off when the 
valve opens. No crew controls are necessary. 


Water Tank Regulator Inlet Valve 


The ЊО ТК № REG INLET valve in each 
nitrogen system permits nitrogen to flow to its 
regulator and НО TK № ISOL SYS 1, 2 valve. 
The REG inlet and isolation manual valves are 
on panel MO10W. Тһе regulator in each 
nitrogen system reduces the 200-psi supply 
pressure to 15.5 to 17.0 psig. Each regulator is a 
two-stage regulator with the second stage 
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relieving pressure into the crew cabin at a 
differential pressure of 18.5 + 1.5 psig. 


Airlock Depressurization and 
Equalization Valves 


The airlock pressure is maintained equal with 
cabin pressure via the airlock equalization 
valves located on the cabin/airlock hatch. 
During normal operations the airlock hatch is 
open. The airlock depressurization valve is 
used to depressurize the cabin to 10.2 psia and 
to depressurize the airlock for EVA. 


Atmospheric Revitalization System 


The atmospheric revitalization system (ARS) 
circulates air and water throughout the cabin to 
control ambient heat, relative humidity, carbon 
dioxide, and carbon monoxide levels. The ARS 
also provides cooling for cabin avionics. 


Cabin air is circulated around the cabin to 
remove heat and humidity. The heated air is 
then ducted (via cabin fans) to the cabin heat 
exchanger, where the heat is removed by the 
water coolant loops. The water coolant loop 
system collects heat from the cabin heat 
exchanger, the inertial measurement unit (IMU) 
heat exchanger, the cold-plated electronic units 
in the avionics bays, and the avionics bay heat 
exchangers. The water coolant loop transfers 
the heat collected to the Freon/water heat 
exchanger of the active thermal control system. 
The active thermal control system then expels 
the heat overboard. 


Cabin Air Flow 


Except for ducting, all air loop components are 
located under the middeck floor. The air 
circulated through the flight crew cabin also 
picks up odor, carbon dioxide, debris, and 
additional heat from electronic units in the crew 
cabin. Based on the crew cabin volume of 2,300 
cubic feet and 330 cubic feet of air per minute, 
one volume crew cabin air change occurs in 
approximately 7 minutes, and approximately 
8.5 air changes occur in 1 hour. 
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Cabin 


Temperature: 65 to 80 F 
Humidity: 30 to 75 percent 


Oxygen partial pressure: 2.29 psia to 3.45 psia 
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Cabin Air 


The heated cabin air is drawn through the cabin 
loop and through a 300-micron filter by one of 
two cabin fans. Each cabin fan (A and B) is 
controlled by its respective CABIN FAN switch 
on panel L1. Normally, only one fan is used. 


Each fan is powered by a three-phase, 115-volt 
AC motor. These 495-watt motors produce a 
nominal flow rate of 1,400 lb/hr through the 
cabin air ducting. A check valve located at the 
outlet of each fan prevents air from backflowing 
through the non-operating fan. This flapper- 
type check valve will open if there is a 2-inch 
Н:О (.0723 psi) differential pressure across the 
valve. A cabin fan will not start on two phases 
of ac. However, if the cabin fan is already 
operating when a phase of AC is lost, the fan 
will continue to run on two phases of ac. A 
cabin fan can be started on 2-1/2 phases of ac, 
with the extra half phase provided by the 
induced voltage generated by other rotating 
equipment (that is, fans and pumps) running on 
that AC bus. If a phase of AC is lost with a 
short, then the induced voltage will not be 
usable, and starting the cabin fan will not be 
possible. 
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Lithium Hydroxide Canisters 


The cabin air leaves the cabin fan at a rate of 
about 1,400 lb/hr. An orifice in the duct directs 
approximately 120 lb/hr to each of two lithium 
hydroxide (LiOH) canisters, where carbon 
dioxide is removed, and activated charcoal 
removes odors and trace contaminants. The 
canisters are changed periodically on a 
predetermined schedule, generally one or two 
times a day, through an access door in the 
middeck floor. (For larger crews, the canisters are 
changed more frequently.) Each canister is 
rated at 48 man-hours. Up to 30 spare canisters 
are stored under the middeck floor in a locker 
between the cabin heat exchanger and water 
tanks. The LiOH canisters are the primary means of 
carbon dioxide (CO2) control onboard the orbiter. 


CAUTION 
During lithium hydroxide canister changeout, 
the cabin fan(s) should be turned off. Dust 


from the canisters kicked up by a cabin fan 
has caused eye and nose irritation. Lithium 
hydroxide dust may also be a contributing 
factor to humidity separator failures. 
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Carbon Dioxide Absorbers 


Regenerable Carbon Dioxide Removal System 


OV-105 has the hardware capability to perform 
RCRS operations designed for use on long-duration 
standalone missions. However, the hardware is not 
needed while docked to the ISS, and the RCRS is not 
planned to be used in the future. This is presented as 
historical information. 


The ability to use the RCRS in the EDO orbiters 
solved a major weight and volume stowage 
problem encountered when attempting to con- 
duct 10 to 16 day duration missions for a crew 
of up to seven astronauts. Carbon dioxide 
removal is accomplished by passing cabin air 
through one of two identical solid amine resin 
beds. The resin consists of a polyethylenimine 
(PEI) sorbent coating on a porous polymeric 
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substrate. Upon exposure to carbon dioxide 
laden cabin air, the resin combines with water 
vapor in the air to form a hydrated amine which 
reacts with carbon dioxide to form a weak 
bicarbonate bond. Water is required for the 
process since dry amine cannot react with the 
carbon dioxide directly. While one bed adsorbs 
carbon dioxide, the other bed regenerates with 
thermal treatment and vacuum venting. This 
latter requirement prevents the use of the RCRS 
during ascent ог entry. The adsorp- 
tion/regeneration process runs continuously 
with the beds automatically alternating proc- 
esses every 13 minutes. A full cycle is made up 
of two 13 minute cycles. An RCRS configured 
vehicle uses a single LiOH canister for launch 
and another for entry. An activated charcoal 
canister іп the other CO» absorber slot removes 
odors. It is changed out mid mission on 10+ day 
flights. 


When flown, the RCRS is located in volume D 
under the middeck floor. In addition to the two 
chemical beds, the major components of the 
RCRS include a set of vacuum cycle and 
pressure equalization valves, an RCRS fan, an 
airflow control valve, ап ullage-save 
compressor, and two redundant controllers (1 
and 2. Тһе airflow control valve is set 
prelaunch for either a crew size of "4" or "5 to 7" 
crewmembers. These two positions select 
airflow through the КСК of 72 or 110 lb/hr 
respectively. The control switches for the RCRS 
are located on panel МОБ1Е. Both AC and DC 
power for the 1 and 2 controllers are operated 
from this panel. Each controller has a three 
position momentary switch for selection of 
OPER or STBY. This panel also has status lights 
for each controller that illuminate OPER or FAIL 
as appropriate. Crew insight into RCRS 
operation is found оп SPEC 66 
ENVIRONMENT in OPS 2. 


The scrubbed air is then forced through the 
cabin heat exchanger. 
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Cabin Air Temperature Control 


The cabin temperature control valve is a 
variable position valve that proportions the 
volume of air that bypasses the cabin heat 
exchanger. The valve may be positioned 
manually by the crew, or automatically by one 
of the two cabin temperature controllers. The 

cabin temperature controller is a motor-driven MM 
actuator that adjusts the cabin temperature Тус 
control valve to achieve the temperature 
selected by the CABIN TEMP rotary switch on 
panel L1. The cabin temperature control valve 
and the two controllers are located in the ECLSS 


bay below panel MD44F. 

When the CABIN TEMP CNTLR switch on 

panel L1 is positioned to 1, it enables controller шу QM Bay зга 

1. The rotary CABIN TEMP switch elects and = | m 
automatically controls the bypass valve by | | © Б 
diverting 0 to 70 percent of the air flow around ЕЕ" 


the cabin heat exchanger, depending on the 


position of the switch. Normally, full COOL | Lum (0) 


corresponds to a temperature of approximately 65° Е, 
and full WARM corresponds to about 80° F. 


| HUMIDITY SEP, CABIN TEMP, CABIN 
The controllers are attached to a single bypass TEMP CNTLR, and CABIN FAN Switches 


valve by an actuator arm. If controller 1 on panel L1 
malfunctions, the actuator arm linkage must be 
removed from controller 1 by the flight crew at 
panel MD44F and connected manually to deir 
controller 2 before the CABIN TEMP CNTLR Ue Pes 
switch on panel L1 is positioned to 2. This — | Фе өр? 
enables controller 2 and permits the rotary et temperature . си Мы 
CABIN TEMP switch to control controller 2 апа Avionics bay 2 air » ||| ES d 
the single bypass control valve. The CABIN (эд чөлөө ||, Eid 
TEMP СМПК switch’s OFF position removes Оше temperature ГЕ: En 
electrical power from both controllers, the Cabin heat exchanger Ec J 
rotary switch, and automatic control of the @-»oettmperature SN РАКА 
single bypass valve. For ascent and entry, the Yellow ONE ge 
CABIN TEMP is set to full COOL to ensure ER m cr 
maximum air cooling during these relatively - = г «осы 

> anel F7 delta pressure 
warm phases of flight. хэй. 


376.cvs 
The air from the cabin heat exchanger and the 
bypassed air come together in the supply duct 
downstream of the heat exchanger and are 
exhausted into the crew cabin through the CDR 
and PLT consoles and through various station 
duct outlets into the crew cabin. 


Avionics Bay and Cabin Heat Exchanger 
Temperature Monitoring and 
Caution/Warning, Crew Cabin Air 
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Cabin Temperature Monitoring 


The cabin heat exchanger outlet temperature is 
transmitted to a rotary switch below the AIR 
TEMP meter on panel O1. When the switch is 
positioned to CAB HX OUT, the temperature 
can be monitored on the meter. The cabin heat 
exchanger outlet temperature provides an input 
to the yellow AV BAY/CABIN AIR caution and 
warning light on panel F7. The light is 
illuminated if the cabin heat exchanger outlet 
temperature is above 145° F, if avionics bay 1, 2, 
or 3 temperatures exceed 130° F, or if the cabin 
fan delta pressure is less than 4.2 inches of 
water or above 6.8 inches of water. 
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AIR TEMP Meter and Switch on Panel O1 
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Manual Temperature Control 


If cabin temperature controllers 1 and 2 or the 
CABIN TEMP rotary switch on panel L1 are 
unable to control the single bypass valve, the 
flight crew can position the single bypass valve 
actuator drive arm to the desired position and 
pin the bypass valve arm to one of four fixed 
holes (FULL COOL, FULL HEAT, etc.) on panel 
MD44F. The FULL COOL position establishes 
the maximum cabin air flow rate to the cabin 
heat exchanger, the 2/3 COOL position 
establishes а flow rate that provides 
approximately two-thirds of the maximum 
cooling capability, the 1/3 COOL position 
establishes а flow rate that provides 
approximately one-third of the maximum 
cooling, and the FULL HEAT position 
establishes the minimum cabin air flow rate to 
the cabin heat exchanger. 


PRIMARY SECONDARY 
ACTUATOR ACTUATOR 


2/3 COOL 
» 


, 
1/3 COOL 


S FULL соо. ЖП НЕАТ 


Manual Temperature Controls 
on Panel MD44F 


Cabin Air Humidity Control 


Cabin air is directed to the crew cabin heat 
exchanger, where heat is transferred to the water 
coolant loop. Humidity condensation that forms 
in the heat exchanger is pushed by the air flow to 
the slurper. One of two humidity separators 
draws air and water from the slurper. In the 
humidity separator, centrifugal force separates 
the water from the air. The fan separator 
removes nominally about 1 and up to 
approximately 4 pounds of water per hour. The 
water is routed to the waste water tank, and the 
air is ducted through the exhaust for return to the 
cabin. There are two fan separators (A and B) 
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controlled individually by HUMIDITY SEP A 
and B switches on panel L1. Normally, only 
one fan separator is used. The relative 
humidity in the crew cabin typically 15 
maintained between 30 and 65 percent in this 
manner. 


The orbiters have been modified to allow 
redirecting the condensate water from the 
humidity separator to a contingency water 
container (CWC) while оп orbit. This 
modification is in support of ISS missions where 
waste tank dumping will be minimized while 
docked. Once undocked, the CWC will be 
dumped overboard through the contingency 
crosstie waste quick disconnect. 


A small portion of the revitalized and 
conditioned air from the cabin heat exchanger is 
ducted to the carbon monoxide removal unit 
(the ambient temperature catalytic oxidizer, or 
ATCO), which converts carbon monoxide to 
carbon dioxide. A bypass duct carries warm 
cabin air around the cabin heat exchanger and 
mixes it with the revitalized and conditioned air 
to control the crew cabin air temperature 
between 65° and 80° F. 


Avionics Bay Cooling 


Cabin air is also used to cool the three avionics 
equipment bays and some of the avionics units 
in the bays. Each of the three avionics equip- 
ment bays in the middeck has a closeout cover 
to minimize air interchange апа thermal 
gradients between the avionics bay and crew 
cabin; however, the covers are not airtight. For 
all practical purposes, air circulation is closed 
loop within the bay. The electronic avionics 
units in each avionics bay meet outgassing and 
flammability requirements to minimize toxicity 
levels. 


Each of the three avionics equipment bays has 
identical air-cooling systems. Two fans per bay 
are controlled by individual AV BAY 1, 2, 3 
FAN A and B switches on panel L1. Normally, 
only one fan is used at a time. When the A or B 
switch for an avionics bay is positioned to ON, 
the fan draws air from the floor of the avionics 
bay through the applicable air-cooled avionics 
units and a 300-micron filter into the avionics 
bay fan. 
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Note: The fan duct work for Av Bay ЗА has | 
been modified to accept a larger cabin fan for 
additional middeck cooling for payloads that | 
will be stowed in the middeck for ISS missions. 
The standard avionics bay fans will be flown 
until the larger fan is needed. 


The avionics bay fan outlet directs the air 
through that avionics bay heat exchanger, 
located beneath the middeck crew compartment 
floor. The water coolant loops flow through the 
heat exchanger to cool the fan outlet air, and 
the cooled air is returned to the avionics bay. 
A check valve in the outlet of the fan that is 
not operating prevents a reverse flow through 
that fan. 


The air outlet temperature from the fan in each | 
avionics bay is monitored and transmitted to a 
rotary switch on panel O1. When the switch is 
positioned to AV BAY 1, 2, or 3, that avionics 
bay’s fan outlet temperature can be displayed 
on the AIR TEMP meter. The air outlet 
temperature of each avionics bay also provides 
an input to the yellow AV BAY/CABIN AIR 
caution and warning light on panel F7. This 
light is illuminated if any of the avionics bay 
outlet temperatures are above 130° F. The OFF 
position of the A or B switch removes power 
from that avionics bay fan. 


Inertial Measurement Unit (IMU) Cooling 


The three IMUs are cooled by one of three fans 
drawing cabin air through a 300-micron filter 
and across the three IMUs. The fans are located 
in AV Bay 1. The fan outlet air flows through 
the IMU heat exchanger located on the flight 
deck and is cooled by the water coolant loops 
before returning to the crew cabin. Each IMU 
fan is controlled by the IMU FAN switches on 
panel L1. The ON position turns the 
corresponding fan on, and the OFF position 
turns it off. Normally, one fan is sufficient 
because one fan cools all three IMUs. A check 
valve is installed on the outlet of each fan to 
prevent a reverse airflow through the fans that 
are not operating. 
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Water Coolant Loop System 


The water coolant loops circulate water through 
the crew compartment to collect excess heat and 
transfer it to the Freon coolant loops. Two 
complete, separate water coolant loops flow side 
by side and can operate at the same time, 
although only one is active at any given time. 
Loop 2 is normally the active loop. The only 
difference between loops 1 and 2 is that loop 1 
(the backup) has two water pumps, and loop 2 
has one pump. The water pumps are located in 
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the ECLSS bay below the forward lockers. The 
pumps are powered by three-phase, 117-volt AC 
motors. 


Some electronic units in each of the avionics 
equipment bays and in the cabin are mounted on 
cold plates. The water coolant loops flow through 
the cold plates, and the heat generated by the 
electronics unit is transferred to the cold plate and 
then to the water coolant loop, which carries heat 
from the electronic unit. The cold plates mounted 
on the shelves in each avionics bay are connected 
in a series-parallel arrangement with respect to 
the water coolant loop flow. 
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exchanger 


To water coolant 

loop/freon-21 coolant loop 

interchanger (midiuselage) 
380.28 


Crew Cabin Water Coolant Loops 


The status of the water loops can be monitored on 
the APU/ENVIRON THERM display (DISP 88), 
which is available in SM OPS 2. The information is 
found in the items under Н20 LOOP. 


Water Loop Pumps 


A ball-type check valve downstream of each water 
pump in loop 1 prevents reverse flow through the 
non-operating pump. The water pumps in 
coolant loop 1 are controlled by the Н:О PUMP 
LOOP 1 A and B switch on panel L1 in 
conjunction with the H:O PUMP LOOP 1 СРС, 
OFF, ON switch beside it. The ON position 
continuously energizes the loop 1 pump. The GPC 
position enables the general-purpose computer 
to command the loop 1 pump, which is selected 
by the Н:О PUMP LOOP 1 A or B switch, to 
circulate water through water coolant loop 1 
nominally for 6 minutes every 4 hours while on 
orbit (OPS 2) to thermally condition the 
normally static loop. The OFF position removes 
electrical power from both the A and B pumps 
of loop 1. 


The coolant loop 2 water pump is controlled by the 
Н:О PUMP LOOP 2 switch on panel L1. The ON 
position energizes the loop 2 water pump 
continuously. In OPS 2, when the switch is 
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positioned to GPC, water pump 2 is commanded by 
the GPC to circulate water through water coolant 
loop 2 for 6 minutes every 4 hours. In OPS 1, 3, 
and 6, the GPC-ON command for the water loop 2 
pump stays resident in the BFS, so taking the switch 
to the GPC position immediately activates the pump 
(assuming the associated pump power circuit breakers 
are closed). The OFF position removes electrical 
power from water coolant loop 2 pump. 


Water Loop Flow 


Water loops 1 and 2 are routed side by side 
through the same areas. Downstream of each 
water pump, water flow splits into three 
parallel paths. One is through the AV Bay 1 
air/water heat exchanger and cold plates. A 
second is through the AV Bay 2 air/water heat 
exchanger and cold plates, and thermal 
conditioning of the crew cabin windows. A 
third is through the crew cabin MDM flight 
deck cold plates, the AV Bay 3A air/water heat 
exchanger and cold plates, and the AV Bay 3B 
cold plates. The three parallel paths in each 
coolant loop then rejoin upstream of the 
Freon/water heat interchanger. The flow path 
splits again with one parallel path in each water 
coolant loop flowing through the Freon/ water 
interchanger, where the water loop is cooled. 
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The cooled water then flows through the liquid- 
cooled garment heat exchanger, potable water 
chiller, cabin heat exchanger, and IMU heat 
exchanger to the respective water coolant loop 1 
and 2 pump package. The other parallel path in 
each water coolant loop, containing warm 
water, bypasses the interchanger and heat 
exchanger, rejoining the loop at the loop pump 
package. A valve installed in the bypass path 
controls the amount of bypass flow, thus 
controlling the mixed water temperature out of 
the pump package. 


The bypass valve is controlled by bypass 
controllers either manually or automatically via 
Н:О LOOP 1 and 2 BYPASS MODE switches on 
panel L1. When the switch is positioned to 
AUTO, the water bypass controller and bypass 
valve automatically control the amount of water 
in the coolant loop that bypasses the 
Freon/ water interchanger and heat exchangers 
in an attempt to maintain a pump outlet set point 
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temperature of 63.0 + 2.5° F. When the water 
pump’s outlet temperature exceeds the set point 
temperature, the loop’s bypass valve is 
commanded to close, and more loop flow is 
directed to the Freon/water interchanger to 
provide increased cooling. 


When the bypass controller senses that the 
water pump’s outlet temperature is below the set 
point temperature, the controller increases the 
amount of water bypassed around Ње 
Freon/ water interchanger, reducing the heat 
rejection rate and increasing the water 
temperature out of the pump outlet. When the 
Н;О LOOP BYPASS MODE switch for the 
coolant loop is positioned to MAN, the flight 
crew uses the corresponding Н:О LOOP MAN 
INCR/DECR momentary switch on panel L1 to 
manually control the bypass valve position in 
that water coolant loop. 
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The bypass valve is manually adjusted before 
launch to provide a flow of approximately 950 
pounds per hour through the Freon/water 
interchanger, and the control system remains in 
the manual mode until post insertion. On orbit, 
the active water coolant loop's Н:О LOOP 
BYPASS MODE switch is set to AUTO and the 
bypass valve automatically controls the loop so 
that the water pump’s outlet temperature 
remains at about 63° F. 


The accumulator in each water coolant loop 
provides а positive pressure оп the 
corresponding water pump inlet апа 
accommodates thermal expansion and dampens 
pressure surges in that water coolant loop when 
the pump is turned on or off. Each accumulator is 
pressurized with gaseous nitrogen at 19 to 35 psi. 


The pressure at the outlet of the water pump in 
each water coolant loop is monitored and 
transmitted to the Н.О PUMP OUT PRESS 
meter on panel O1. When the switch below the 
meter is positioned to LOOP 1 or LOOP 2, the 
corresponding water coolant loop’s pressure in 
psia is monitored on the meter. 


NOTE 


For normal operations, only one water 
loop is active (usually loop 2). Running 
two water loops for long periods of time 
is undesirable. Two operating loops will 
flow too much water through the 
Freon/ water interchanger and result іп a 
significant increase in the cabin 
temperature. This occurs because two 
active water loops are capable of picking 
up more heat than the Freon/water 
interchanger can transfer to the Freon 
loops. Over time, the water loops will 
start to heat up, and cooling efficiency 
will decrease. 


The yellow Н:О LOOP caution and warning 
light on panel F7 will be illuminated if the 
outlet pressure of the water coolant loop 1 
pump is less than 19.5 psia or greater than 79.5 
psia, or if the outlet pressure of the loop 2 pump 
is less than 45 psia or greater than 81 psia. The 
pump outlet pressure and delta pressure across the 
pump of each coolant loop are monitored and 
transmitted to the systems management GPC 


2. SYSTEMS 


for DPS display readout on the DISP 88 
APU/ENVIRON THERM display (PUMP 
OUT P). 
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Н:О PUMP OUT PRESS Meter and Switch 
on Panel O1 (The same transducer feeds SM 
DISP 88) 


Active Thermal Control System 


The active thermal control system (ATCS) 
provides orbiter heat rejection during all phases 
of the mission after solid rocket booster 
separation. The system consists of two 
complete, identical Freon coolant loops, cold 
plate networks for cooling avionics units, 
liquid/liquid heat exchangers, and three 
onboard heat sinks: radiators, flash evaporators, 
and ammonia boilers. 


Freon Loops 


Two Freon coolant loops transport excess heat 
from the Freon/water interchanger, fuel cell 
heat exchanger, payload heat exchanger, and 
midbody and aft avionics electronic units. The 
Freon loops then deliver the heat to the heat 
sinks. Each loop has a pump package 
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consisting of two pumps and an accumulator. 
The pump package is located in the midbody of 
the orbiter below the payload bay liner. One 
pump in each loop is active at all times. The 
metal bellows-type accumulator in each loop is 
pressurized with gaseous nitrogen to provide a 
positive pressure on the pumps and permit 
thermal variation in that coolant loop. When the 
accumulator bellows is fully extended, 
approximately 80 Їр of Freon is in the 
accumulator (normally only 20 to 30 percent of 
this amount is used). А Бай check valve 


AFT COLDPLATES 


RADIATOR KIT PANEL 
AFT RADIATOR PANEL 
FUEL CELL HX 


FORWARD DEP 
RADIATOR PAN 


H20 FREON 

INTERCHANGER 
FREON 21 
PUMP PACKAGE 


USA007587 
Rev. A 


downstream of the pumps in each coolant loop 
prevents a reverse flow through the non- 
operating pump in the loops. The pumps in 
each coolant loop are controlled individually by 
the FREON PUMP switches on panel L1. When 
either switch is positioned to A or B, the 
corresponding Freon pump іп that loop 
operates. The OFF position of each switch 
prohibits either Freon pump in that coolant loop 
from operating. 


RADIATOR FLOW 
CONTROL ASSEMBLY 


FLOW PROPORTIONING MODULE 
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Active Thermal Control System Component Locations 
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When a Freon pump is operating, Freon is 
routed in parallel paths through the fuel cell 
heat exchanger and the midbody cold plate 
network to cool electronic avionics units, 
including the station/shuttle power transfer system 
(SSPTS) electronics. The Freon coolant 
converges to one flow path before entering the 
hydraulics heat exchanger. 


Normally, the warmest portion of the Freon loop is at 
the outlet of the hydraulic system heat exchanger. 
The Freon flows from the hydraulic fluid heat 
exchanger to the radiators, which are bypassed 
through a bypass valve during ascent and entry 
unless cold soak cooling from the radiators is 
being used. 


When the payload bay doors are opened on or- 
bit, radiators located on the inside of the 
payload bay doors are used for heat rejection to 
space. After the radiators, the Freon coolant 
flows through the ground support equipment 
heat exchanger (used for providing prelaunch and 
post-landing cooling), ammonia boilers, and 
flash evaporator located in the aft fuselage. It is 
then divided into two parallel paths. One path 
flows through the cargo heat exchanger (located 
on the left side roughly center of the 
midfuselage) and continues through the ECLSS 
oxygen restrictor to warm cryogenic oxygen to 
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about 40? F. The flows splits through a flow- 
proportioning valve module into parallel paths 
to the payload heat exchanger, and atmospheric 
revitalization system Freon/water interchanger 
(located in the lower forward portion of the 
midfuselage) and then returns to a series flow. 
The second path flows in series through aft 
avionics bays 4, 5, and 6 to cool electronic 
avionics equipment. Тһе flow continues 
through cold plates to cool four rate gyro 
assemblies. The parallel paths combine and 
return in series to the Freon coolant pump in 
that Freon coolant loop. 


The FREON FLOW meter on panel O1 permits 
the crew to monitor Freon flow to the Freon/ 
water interchanger. The switch below the meter 
selects the loop to be monitored. Freon loop 
status can also be monitored under the FREON 
LOOP area on the APU/ENVIRON THERM 
display (DISP 88) and the ВЕ5 THERMAL 
display (FREON Loop 1, 2) in OPS 1. The 
yellow FREON LOOP caution and warning light 
on panel F7 will illuminate if Freon/water 
interchanger (ICH) flow in either loop is less 
than 1186 Ibm/hr. Тһе crew has no insight into 
total loop flow. 
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Radiators 


Radiators act as a heat sink for the coolant 
loops. The radiator system consists of four 
radiator panels attached to the inside of each 
payload bay door. The two forward radiator 
panels on each payload bay door are deployable 
when the doors are opened on orbit. The heat 
rejection requirements of the orbiter for a 
specific mission will determine if the forward 
radiators are to be deployed. The third and 
fourth radiator panels are fixed to the aft 
underside of the aft right and left payload bay 
doors and are not deployable. 


The maximum heat rejection capability is 61,100 
Btu per hour. When the payload bay doors are 
closed, the radiators are usually bypassed. 


The radiator panels on the left and right sides 
are each configured to flow in series, while flow 
within each panel is parallel through a bank of 
tubes connected by an inlet and outlet connector 
manifold. The radiator panels on the left side 
are connected in series with Freon coolant loop 
1. The radiator panels on the right side are 
connected in series with Freon coolant loop 2. 
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The radiator panels provide an effective heat 
dissipation area of 1,195 square feet on orbit. 
Each radiator panel is 10 feet wide and 15 feet 
long. The Freon tubing in the radiator panels is 
more than 1 mile long. 


For ascent, the radiators are normally bypassed 
since the doors are closed. Radiator flow is 
established shortly before the doors are opened 
on orbit. During deorbit preparations, prior to 
closing the doors, the Freon in the radiators is 
cold-soaked by positioning the orbiter in a tail 
Sun attitude and slowing flow through the radiators 
by taking the RAD CONTROLLER OUT TEMP 
switch to the HI position on panel L1. This cold 
soak is saved for use as a heat sink during the 
latter stages of entry. 
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Radiator Mounting and Construction 


The deployable radiators are secured to the 
inside of the right and left payload bay doors by 
six motor-operated latches. When the payload 
bay doors are opened on orbit, if the mission 
dictates that the deployable radiators be 
deployed, then the six motor-driven latches 
unlatch the radiators from the payload bay 
doors, and a motor-driven torque-tube-lever 
arrangement deploys the forward radiators at 
35.5? from the payload bay doors. Deploying 
the forward radiators provides more surface 
area, and thus greater heat rejection. 


The aft fixed radiator panels are attached to the 
payload bay doors by a ball joint arrangement 
at 12 locations to compensate for movement of 
the payload bay door and radiator panel caused 
by the thermal expansion and contraction of 
each member. 
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The radiator panels are made of an aluminum 
honeycomb face sheet 126 inches wide and 320 
inches long. The forward deployable radiator 
panels are two-sided and have a core thickness of 
0.9 of an inch. They have longitudinal tubes 
bonded to the internal side of both face sheets. 
Each of the forward deployable panels contains 
68 tubes spaced 1.9 inches apart. 


Each tube has an inside diameter of 0.131 inch. 
Each side of the forward deployable radiator 
panels has a coating bonded by an adhesive to 
the face sheet consisting of silver-backed Teflon 
tape for proper emissivity properties. The aft 
fixed panels are one-sided, and their cores are 
0.5 inch thick. They have tubes only on the 
exposed side of the panel and a coating bonded 
by an adhesive to the exposed face sheet. The 
aft panels contain 26 longitudinal tubes spaced 
4.96 inches apart. Each tube has an inside 
diameter of 0.18 inch. The additional thickness 
of the forward radiator panels is required to 
meet deflection requirements when the orbiter 
is exposed to ascent acceleration. 


Radiator Deploy Systems 


There are two radiator deploy systems, each of 
which drives one of two motors on each door. 
The systems drive the radiator panels away 
from the payload bay doors (deployed) or to the 
stowed position, using two reversible three- 
phase AC motors. It takes 50 seconds to deploy 
or stow the radiators. 


The crew deploys and stows the radiators using 
switches on panel R13L. To deploy, the PL BAY 
MECH PWR SYS 1 and SYS 2 switches are set to 
ON to provide power to the panel switches. 
Both RADIATOR LATCH CONTROL switches 
are set concurrently to RELEASE; after 30 
seconds, they are set to OFF. The RADIATOR 
CONTROL switches are then concurrently set to 
DEPLOY; after 50 seconds, they are set to OFF. 
The PL BAY MECH PWR switches are then set 
to OFF. 


To stow the radiators, the PL BAY MECH PWR 
switches are again positioned to ON. The 
RADIATOR CONTROL switches are both 
concurrently set to STOW, and after 50 seconds 
to OFF. The LATCH CONTROL switches are 
then positioned to LATCH, and after 30 seconds, 
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to OFF. The PL BAY MECH PWR switches are 
then positioned to OFF. 
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Single Radiator Operations 


It is possible to deploy either the port side or the 
starboard side radiator independently. This 
cannot be done directly with switches, because 
each controls motors on both sides. To deploy 
only one radiator, circuit breakers must be 
pulled to disable motors on one side. Single 
radiator operations may be done in case of a 
contingency situation, such as failure of one 
radiator or necessary Ku-Band antennae 
pointing, or a planned situation, such as flying 
in an attitude such that one door must remain 
partially closed to protect against debris strikes. 


Radiator Flow Control 


A radiator flow control valve assembly in each 
Freon coolant loop controls that loop’s 
temperature via variable flow control, which 
mixes hot bypassed Freon coolant with the cold 
Freon coolant from the radiators. The radiator 
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bypass valve allows Freon to flow through the 
radiator or bypass the radiator completely. 


In the automatic mode, the RAD CONTROLLER 
LOOP 1 and LOOP 2 switches on panel L1 are 
positioned to AUTO A or AUTO B to apply 
electrical power to the corresponding radiator 
flow controller assembly. The RAD BYPASS 
VALVE MODE switch is positioned to AUTO, 
and the RAD CONTROLLER OUT TEMP switch 
on panel L1 is positioned to NORM ог HI. 


With the RAD CONTROLLER OUT TEMP 
switch on panel L1 positioned to NORM, the 
radiator controller outlet temperature in Freon 
coolant loops 1 and 2 is automatically controlled 
at 38° Е (429) in HI, the temperature is 
automatically controlled at 57° Е (+ 2°). 


NOTE 


To achieve the radiator NORM and HI 
control point temperatures, the radiator panel 
outlet temperature must be at or below the 
corresponding control point temperature. 


NOTE 


If a primary flash evaporator system (FES) 
controller switch on L1 is ON, the FES is 
activated automatically when the radiator 
controller outlet temperature exceeds 41? F 
to supplement the radiators' ability to 
reject excess heat. 


Тһе talkback indicators below the RAD 
CONTROLLER switches on panel L1 indicate the 
position of the bypass valve in that Freon coolant 
loop. The RAD BYPASS VALVE LOOP 1 and 2 
talkback indicators show BYP when the bypass 
valve in that Freon coolant loop is in the bypass 
position, barberpole when the motor-operated 
bypass valve is in transit, and RAD when the 
bypass valve is in the radiator flow position. 


When the RAD BYPASS VALVE MODE switch 
on panel 1.1 is positioned to MAN for the Freon 
coolant loop selected, automatic control of the 
radiator bypass valve in that loop is inhibited, 
and the flight crew controls the bypass valve 
manually using the RAD BYPASS VALVE 
LOOP 1, LOOP 2, MAN SEL switches on panel 
11. 
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When the switch is set to BYPASS, the loop’s 
motor-operated bypass valve causes that Freon 
coolant loop flow to bypass the radiators. When 
the switch is positioned to RAD FLOW, the 
valve permits coolant to flow through the 
radiator and associated flow control valve. 


NOTE 


Besides specifying the NORM or HI radiator 
controller output set point temperature, the 
flow control valve cannot be controlled 
manually -only automatically via the 
controller. The bypass valve can be 
operated manually or automatically. 


Freon Radiator Isolation Valves 


Orbital debris could damage the orbiter Freon 
loop radiators located on the inner surface of 
the payload bay doors. Debris striking a Freon 
coolant line in the radiator could cause loss of 
Freon in that loop. To preclude this loss, a 
method was designed to isolate the punctured 
radiator from the rest of the loop. 


To isolate the affected radiator from the Freon 
loop, AC-powered isolation valves and direc- 
tional-flow check valves with associated 
plumbing were added to the Freon loops. 
Switches on L2 provide control of the isolation 
valves. Power to the valves and control logic 
are provided via circuit breakers on panels L4 
and 014. Тһе AC-powered isolation valve has 
automatic and manual controls. During OPS 2 
orbit operations, with the FREON ISOLATION 
MODE switch in AUTO, if the affected Freon 
loop accumulator quantity drops below a 
threshold quantity (default is 12 percent) for at 
least 3-5 seconds, a class 3 SM alert will 
annunciate and a command will be sent to the 
isolation valve on the affected loop to isolate the 
affected radiator. However, this automatic 
isolation will not occur if the Freon loop 
accumulator quantity shows less than -5% or if 
the status is “M” due to MDM failures. (The 
-5% threshold prevents inadvertent automatic 
radiator isolation in the event of an accumulator 
quantity instrumentation failure; off-scale low for 
Freon loop accumulator quantity is about -11%.) In 
MAN, the crew has to isolate the affected 
radiator manually if a leak is detected by 
holding the affected loops switch in ISOLATE 
until the radiator is isolated (~5 sec). Manual 
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control of the valve can override the auto isolate the radiator. Only manual control of the 
control in “both” directions (RAD FLOW ог radiator isolation valves is available during ascent 
ISOL) to reset the valve to the normal flow and entry (while the SM is managed by the backup 
condition for a system test or for a false failure flight system (BFS)). 

that may have caused the isolation valve to 
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Flash Evaporator System 


The FES rejects heat loads from Freon coolant 
loops 1 and 2 by evaporating supply water in a 
vacuum. The FES is used during ascent above 
140,000 feet, and it supplements the radiators on 
orbit if required. It also rejects heat loads 
during deorbit and entry to an altitude of 
approximately 100,000 feet. 


The FES is located in the aft fuselage of the 
orbiter. There are two evaporators, a high-load 
evaporator and a topping evaporator. Two 
major differences are that the high-load 
evaporator has a higher cooling capacity and 
only one overboard vent on the left side of the 
vehicle. The topping evaporator vents steam 
equally to the left and right sides of the orbiter 
to minimize propulsiveness. The evaporators 
are cylindrical shells with dual water spray 
nozzles at one end and a steam exhaust duct at 
the other end. The shell is composed of two 
separate finned packages, one for each Freon 
loop. The hot Freon from the coolant loops 
flows around the finned shell, and water is 
sprayed onto the inner surface of the shell by 
water nozzles from either evaporator. The 
water vaporizes, cooling the Freon coolant 
loops. In the low-pressure atmosphere above 
100,000 feet, water vaporizes quickly. Changing 
water liquid to vapor removes approximately 
1,000 Btu per hour per pound of water. The 
water for the evaporators is obtained from the 
supply water storage tanks through FES water 
supply feedlines A and B. 


Flash Evaporator Controllers 


The flash evaporators have three controllers: 
primary A, primary B, and secondary. The 
primary A and B controllers have two separate, 
functionally redundant shutdown logic paths 
(under-temperature апа over-temperature with 
insufficient rate of cooling). The secondary 
controller has no automatic shutdown capability. 
The flash evaporator controllers are enabled by 
the FLASH EVAP CONTROLLER switches on 
panel L1. The PRI A switch controls primary 
controller A, the PRI B switch controls primary 
controller B, and the SEC switch controls the 
secondary controller. 


When the PRI A, PRI B, or SEC switch is 
positioned to GPC, the corresponding controller 
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is turned on automatically during ascent by the 
backup flight system (BFS) computer as the 
orbiter ascends above 140,000 feet (MM103/SRB 
SEP). During entry, the BFS computer turns the 
corresponding controller off as the orbiter 
descends below about 100,000 feet (MM305). The 
ON position of the switch provides electrical 
power directly to the corresponding flash 
evaporator controller. The OFF position of the 
switch removes all electrical power and inhibits 
flash evaporator operation. 


The primary A controller controls water flow to 
the flash evaporator from water supply system 
A through water feed line A. The primary B 
controller controls water flow to the flash 
evaporator from water supply system B through 
water feed line B. 


NOTE 


When a primary controller is enabled, both 
High Load and Topping evaporators can be 
used simultaneously. 


The secondary controller controls water flow to 
the high load flash evaporator from water 
supply system A through feed line A if the 
FLASH EVAP CONTROLLER SEC switch on 
panel ІЛ is in the A SPLY position, and if the HI 
LOAD EVAP switch is in the ENABLE position. 
If the switch is in the B SPLY position, and the 
HI LOAD EVAP switch is in the ENABLE 
position, the secondary controller controls water 
flow to the flash evaporator from water supply 
system B through feed line B. When the 
secondary controller is used, and the HI LOAD 
EVAP switch is OFF, both the A and B water 
supply systems will feed the topping 
evaporator in an alternate pulsing fashion; the 
high load evaporator is disabled. When the 
secondary controller is used, and the HI LOAD 
EVAP switch is in the ENABLE position, the 
topping evaporator is disabled. 


The primary A and B controllers modulate the 
water spray in the evaporator to keep the Freon 
coolant loops' evaporator outlet temperature 
stable at 39 + 1? F. The secondary controller 
modulates the water spray in the evaporator to 
control the Freon coolant loops’ evaporator 
outlet temperature at 62? F. The temperature 
sensors are located at the outlets of both 
evaporators. 
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The applicable FES controller pulses water into 
the evaporators, cooling the Freon. The steam 
generated in the topping evaporator is ejected 
through two sonic nozzles at opposing sides of 
the orbiter aft fuselage to reduce payload water 
vapor pollutants on orbit and to minimize 
venting thrust effects on the orbiter’s guidance, 
navigation, and control system. 


The high-load evaporator is used in conjunction 
with the topping evaporator during ascent and 
entry when higher Freon coolant loop 
temperatures impose a greater heat load that 
requires a higher heat rejection. The HI LOAD 
EVAP switch on panel 11 must be in the 
ENABLE position for high-load evaporator 
operation. After leaving the  high-load 
evaporator, Freon flows through the topping 
evaporator for additional cooling. The steam 
generated by the high-load evaporator is ejected 
through a single sonic nozzle on the left side of 
the orbiter aft fuselage. The high-load 
evaporator normally would not be used on orbit 
because the high heat rejection capability of the high 
load evaporator is not normally needed on orbit 
when radiator cooling is available, and attempting to 
use the high-load evaporator under low heat load 
would likely cause the evaporator controller to shut 
down. The high load also has a propulsive vent 
(causing unbalanced rates on the vehicle), and it 
might contaminate a payload. 


NOTE 


Norm jets are required to control vehicle 
attitude when the FES high load is used 
on orbit. 


FES Auto Shutdown 


Each primary controller has an automatic 
shutdown capability to protect the evaporator 
from over- or undertemperature conditions. 
Тһе  evaporators outlet temperature 15 
monitored to determine whether a thermal 
shutdown of the evaporator is warranted. Ш the 
evaporator outlet temperature goes below 37? F 
for 20 seconds or more, an undertemperature 
shutdown of the evaporator occurs. Ш the 
evaporator outlet temperature is greater than 
41? F for 55 seconds, the overtemp shutdown 
logic is enabled. An overtemp shutdown occurs 
when the cooling rate is less than 2.1 to 7.8? F 
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per minute from 20 to 40 seconds after the | 
overtemp logic is enabled. If the evaporator is 
shut down, electrical power to the affected 
controller must be recycled to  re-enable 
operations. 


Temperature Monitoring 


The evaporator outlet temperature of Freon 
coolant loops 1 and 2 is transmitted to panel O1. 
When the switch below the FREON meter on 
panel O1 is positioned to LOOP 1 or LOOP 2, 
the evaporator outlet temperature of Freon 
coolant loops 1 or 2 can be monitored in degrees 
Fahrenheit on the FREON EVAP OUT TEMP 
meter or on the DISP 79 SM SYS SUMM 2 
display (EVAP OUT T) or on the DISP 88 
APU/ENVIRON THERM display. If the outlet 
temperature drops below 32.2? Е, or rises above 
64.8?F (after post insertion), the red FREON 
LOOP caution and warning light on panel F7 
will be illuminated. (The upper limit for ascent 
is 

115? Е.) 


FES Heaters 


Electrical heaters are employed on the topping 
and high-load flash evaporators' steam ducts to 
prevent freezing. The HI LOAD DUCT HTR 
rotary switch on panel L1 selects the electrical 
heaters. Switch positions А and B provide 
electrical power to the corresponding 
thermostatically controlled heaters on the high- 
load evaporator steam duct and steam duct 
exhaust. The A/B position provides electrical 
power to both thermostatically controlled 
heaters. Тһе C position provides electrical 
power to both thermostatically controlled C 
heaters. The OFF position removes electrical 
power from all the heaters. 
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The TOPPING EVAPORATOR HEATER DUCT 
rotary switch on panel L1 selects the 
thermostatically controlled electrical heaters on 
the topping evaporator. Positions A and B 
provide electrical power to the corresponding 
heaters, while A/B provides electrical power to 
both A and B heaters. The C position provides 
power to the C heaters and part of the B heaters. 
The OFF position removes electrical power from 
all the heaters. 
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The SM SYS SUMM 2 display is an SM 
display (DISP 79) available in the BFS and in 
PASS SM OPS 2 


The topping evaporator’s left and right nozzle 
heaters are controlled by the TOPPING 
EVAPORATOR | HEATER ЦК) NOZZLE 
switches on panel L1. When the switches are 
positioned to A AUTO or B AUTO, electrical 
power is provided to the corresponding left and 
right nozzle heaters, and the corresponding 
nozzle temperature is maintained between 40° 
and 70° F. The OFF position removes electrical 
power from both heater systems. 


FES Water Dumps 


The FES topping evaporator can be used to 
dump excess water from the supply water 
storage tanks, if required, on orbit. When the 
RAD CONTROLLER OUT TEMP switch on 
panel L1 is placed in HI, the radiator flow 
control valve assembly controls that radiator 
outlet at 57° F. Since the topping evaporator 
controls to 39° F, water is used up at a rate of 
about 25 lb/hr, thus dumping excess water. 


Ammonia Boilers 


The ammonia boiler system acts as a heat sink 
by using the low boiling point of ammonia 
(NH3) to cool the Freon coolant loops when the 
orbiter is below 400,000 feet during entry or on 
the ground after landing. The resultant 
superheated vapor is vented overboard. Two 
complete, individual ammonia storage and 
control systems feed one соттоп boiler 
containing ammonia passages and_ the 
individual Freon coolant loops 1 and 2. Each 
system consists of a storage tank, an isolation 


2. SYSTEMS 


2.9 Environmental Control and Life Support System 


USA007587 
Rev. A 


valve, an overboard relief valve, two control 
valves, a controller, three temperature sensors, a 
pressure sensor and a feedline to the boiler. 


The ammonia boiler is a shell-and-tube system 
with a single pass of ammonia on the ammonia 
side and two passes of each Freon coolant loop 
through the boiler. The ammonia flows in the 
ammonia tubes and the Freon coolant loop 
flows over the tubes, cooling the Freon coolant 
loops. When the ammonia flows over the warm 
Freon coolant lines in the boiler, it immediately 
vaporizes, and the heat and boiler exhaust are 
vented overboard in the upper aft fuselage of 
the orbiter next to the bottom right side of the 
vertical tail. 


The ammonia system is used during entry if the 
radiators have not been cold-soaked, as would be 
the case in the event of an ascent abort. If radiator 
coldsoak cooling is used during entry, the 
ammonia system is activated post-landing when 
radiator outlet temperatures reach 55° F. The 
ammonia boiler operations are used post-landing 
until a ground-cooling cart is connected to the 
ground support equipment (GSE) heat 
exchanger. 


Storage Tanks 


Each ammonia boiler storage tank contains a 
total of 49 pounds of ammonia (approximately 
30 minutes of cooling under nominal post-landing 
conditions), all of which is usable. Each tank is 
pressurized with gaseous helium at a maximum 
operating pressure of 550 psia. Downstream of 
each ammonia storage tank to the common 
boiler are three control valves: a normally 
closed isolation valve, a normally open 
secondary control valve, and a normally open 
primary control valve. A relief valve in each 
ammonia boiler storage system provides 
overpressurization protection of that ammonia 
storage tank. 


Primary Ammonia Boiler Controller 


The primary controller in the ammonia system 
controller energizes the ammonia system 
isolation valve, permitting ammonia to flow to 
two motor-operated controller valves. The 
controller also commands the primary motor- 
operated valve to regulate the flow to the 
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ammonia boiler. Ammonia boiler supply 
systems A and В are enabled by the 
corresponding МНз CONTROLLER switches on 
panel L1. To prepare for the possibility of low 
altitude cooling in the event of an ascent abort, one 
of the NH; CONTROLLER switches (usually B) 
is positioned to PRI/GPC before launch, which 
enables the GPC to control electrical power to 
the primary and secondary controllers within 
the ammonia controllers. When the orbiter 
descends through 120,000 feet їт Major Mode 304 
(or upon transition to Major Mode 602 during a 
return to launch site (RTLS) abort), the backup 
flight system (BFS) computer commands the 
selected ammonia system controller on. 


Ammonia Boiler Control Sensors 


Three temperature sensors associated with 
ammonia system A are affixed to Freon coolant 
loop 1, and three sensors associated with ammonia 
system B are affixed to Freon coolant loop 2. For 
each ammonia system, опе sensor's temperature is 
fed to the primary controller logic to help control 
ammonia boiler Freon outlet temperatures to 35° + 
3° F if the primary controller is active. Also, for 
each ammonia system, а different sensor’s 
temperature helps the secondary controller logic 
control ammonia boiler Freon outlet temperature to 
34° + 3° F if the secondary controller is active. The 
third sensor feeds temperature data to the 
controller’s fault detection logic. If an ammonia 
boiler controller is operating in the PRI/GPC 
configuration and the associated fault detection logic 
senses temperatures below 31.25° F for longer than 
10 seconds, the fault detection logic 
automatically inhibits the primary controller, 
which removes power from the associated 
ammonia system isolation valve and the 
primary control valve. The logic switches to the 
secondary controller in the same ammonia 
system controller, which energizes a redundant 
coil in the ammonia system supply isolation 
valve and adjusts the secondary control valve to 
achieve appropriate Freon outlet temperatures. ТЕ 
commands the isolation valve to full open and 
allows the secondary controller to control the 
secondary control valve to regulate the 
ammonia flow to the ammonia boiler. This 
automatic switchover is only from the primary to the 
secondary controller. 
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NH3CONTROLLER Switches on Panel L1 


Secondary Controller 


When the NH3 CONTROLLER А or B switch on 
panel L1 is positioned to SEC/ON, the A or B 
ammonia system controller is electrically 
powered and enabled directly (no computer 
command is required). The secondary control- 
ler in the ammonia system controller energizes 
the system's isolation valve open, permitting 
ammonia to flow to two motor-operated 
controller valves. The secondary controller also 
commands ifs motor-operated control valve to 
regulate the ammonia flow to the ammonia 
boiler. The three temperature sensors on each 
Freon coolant loop operate and control Freon 
coolant loop 1 and 2 temperature in the same 
manner as in the PRI/GPC mode. Fault detection 
logic does not exist in the secondary controller. 


The OFF position of the NH; CONTROLLER 
switches removes all electrical power from the 
ammonia system controller, rendering the 
ammonia system inoperative. 
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Cargo Heat Exchanger 


The cargo heat exchanger was installed on the 
shuttle in anticipation of a certain type of ISS 
logistics module that needed active cooling from the 
orbiter's Freon coolant loops. The proposed logistics 
modules were demanifested, but OV-103 and OV- 
105 were already outfitted with the heat exchanger, 
cooling lines and accumulator (evacuated), and 
associated coolant line heaters. Іп these vehicles, 
switches for the cargo coolant loop heaters are on 
panel A14. These switches should always be in the 
OFF position and are never expected to be used. 


Supply and Waste Water Systems 


Тһе supply water system provides water for 
flash evaporator system cooling, crew 
consumption, and hygiene. The supply water 
system stores water generated by the fuel cells, 
and the waste water system stores waste from 
the crew cabin humidity separator and from the 
flight crew. Four supply water tanks and one 
waste water tank are located beneath the crew 
compartment middeck floor. 
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Data on the supply and waste water system can 
be monitored on the ENVIRONMENT display 
(DISP 66) under Н2О SUPPLY and WASTE items 
and on the BFS THERMAL display (Н:О SUP Р). 


Supply Water System 


The supply water system consists of four water 
tanks that are pressurized with nitrogen from 
the pressure control system. Each of the four 
supply water tanks has a usable capacity of 165 
pounds of water (plus 3.3 pounds residual), is 35.5 
inches in length and 15.5 inches in diameter, 
and weighs 39.5 pounds dry. 


The three fuel cells generate a maximum of 25 
pounds of supply water per hour (about 0.77 
pounds of water per hour per generated kilowatt). 
The product water from all three fuel cells flows 
to a single water relief control panel. The water 
can be directed to potable water tank A or to the 
fuel cell water relief nozzle. Normally, the 
water is directed to water tank A. 


The product water lines from all three fuel cells 
were modified to incorporate a_ parallel 
(redundant) path of product water to supply 
water tank B in the event of a blockage of the 
primary water path to the tanks. If such a 
blockage were to occur, pressure would build 
up and relieve fuel cell water through the 
redundant paths to the supply water tank B inlet 
manifold. 


Instrumentation 


Temperature sensors are installed on each of the 
redundant paths; in addition, the primary path 
pressure sensor is transmitted to telemetry and 
can be monitored on the BFS THERMAL 
display. A pH sensor is located at the common 
product water outlet of the water relief panel. It 
provides a redundant measurement of fuel cell 
health and water purity. A single measurement 
of water purity in each fuel cell is also provided. 
If a single fuel cell pH sensor indicated high, the 
flight crew would be required to sample the 
potable water to verify the proper pH. 


Hydrogen Separators 


The hydrogen-enriched water from the fuel cells 
flows through the single water relief panel 
through two hydrogen separators to potable 
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water tank A. The separator removes 85 
percent of the excess hydrogen. The hydrogen 
separators consist of а matrix of silver 
palladium tubes, which have an affinity for 
hydrogen. The hydrogen is dumped overboard 
through a vacuum vent. The redundant water 
line to the tank B inlet manifold does not pass 
through the hydrogen separator. Water passing 
through the hydrogen separators can be stored 
in all four supply water tanks: A, B, C, and D. 
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BFS THERMAL Display 


Microbial Filter 


The water entering tank A, which is sterilized 
before launch, passes through a microbial filter 
that adds approximately one-half parts per 
million iodine to the water to prevent microbial 
growth. The water stored in tank A is normally 
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used for flight crew consumption; tanks В, С, 
and D are commonly used for flash evaporator 
cooling. The water from the microbial check 
valve is also directed to a galley supply valve. 
If the water tank A inlet valve is closed, or tank 
A is full, water is directed to tank B through a 
1.5 psid check valve where it branches off to 
tank B. If the tank B inlet valve is closed, or 
tank B is full of water, the water is directed 
through another 1.5 psid check valve to the 
inlets to tanks C and D. 


Each supply water tank has an inlet and outlet 
valve that can be opened or closed selectively to 
use water; however, the tank A outlet valve 
normally remains closed to isolate the treated 
water from the untreated water in the other tank. 
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Tank Pressurization 


Each supply water and waste water tank is 
pressurized with gaseous nitrogen from the 
crew compartment nitrogen supply system. 
The nitrogen and water are separated by a 
metal bellows. Nitrogen supply systems 1 and 
2 can be used individually to pressurize the 
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water tanks with nitrogen at 15.5 to 17.0 psig. 
Nitrogen supply system 1 is controlled by the 
Н:О TK М» REG INLET and Н:О TK № ISOL 
SYS 1 manual valves on panel МОТОМ. 
Nitrogen supply system 2 is controlled by the 
SYS 2 manual valves on panel MO10W. The 
regulator in each nitrogen supply system 
controls the nitrogen pressure to the tanks at 
15.5 to 17 psig, and a relief valve in each 
nitrogen supply system will relieve into the 
crew cabin if the nitrogen supply increases to 
18.5 + 1.5 psig, to protect the tanks from 
overpressurization. 
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Manual Valves on Panel ML26C 


Tank Depressurization 


All the tanks can be vented to cabin pressure, 
but tank A is depressed for ascents, as described 
here. For only tank A, inlet nitrogen pressure is 


controlled by the SPLY ЊО СМ; TK A SPLY | 


and TK VENT manual valves on panel ML26C. 
When the tank A supply valve is closed, the 
tank is isolated from the nitrogen supply. 
When the tank A vent valve is opened, the tank 
is pressurized only by the crew cabin 
atmosphere. For launch, the tank A supply 
valve is closed, and the tank vent valve is 
opened, which lowers tank А pressure by 
removing back-pressurization from the nitrogen 
supply system. The fuel cell water head pressure 
is lower to help prevent flooding of the fuel 
cells during ascent. On orbit, the tank A supply 
valve is opened, and the tank A vent to the 
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cabin is closed, allowing nitrogen supply 
pressure to tank A. 
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controlled from panel R11L, and tank D valves 
are controlled from panel ML31C. When the 
SUPPLY Н20 TK A INLET, TK B INLET, or TK C 
INLET switch on panel R11L is positioned to 
OPEN, the inlet valve for the tank permits water 
into that tank. A talkback indicator above the 
corresponding switch indicates OP when the 
corresponding valve is open, barberpole when 
the valve is in transit, and CL when that valve is 
closed. When the switch is positioned to 
CLOSE, the water inlet to that tank is isolated 
from the inlet water supply. The SUPPLY H;O 
TK D INLET switch and talkback indicator are 
located оп panel ML31C and operate in the 
same manner as the switches and talkbacks for 
tanks A, B, and C. 
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Tank Outlet Valves 


Positioning the SUPPLY Н20 TK A, B, or C 
OUTLET switch on panel R11L to OPEN permits 
water from the corresponding tank to flow from 
the tank into the water outlet manifold due to the 
tank nitrogen pressurization system. A talkback 
indicator above the switch would indicate OP 
when that valve is open, barberpole when it is in 
transit, and CL when it is closed. The CLOSE 
position of each switch isolates that water tank 
from the water outlet manifold. The SUPPLY 
Н:О TK D OUTLET switch and talkback indicator 
are located on panel ML31C and operate in the 
same manner as the tank A, B, and C switches 
and talkback indicators on panel R11L. 


If the supply water tank B outlet valve is opened 
(normally tank A is used only for crew 
consumption), water from the corresponding 
tank is directed to the water outlet manifold. 
The tank A and B water is then available to the 
extravehicular mobility unit (EMU) fill in the 
airlock, to the flash evaporator water supply 
system A, and to the water dump line. The tank 
A outlet valve is normally closed to prevent 
contamination of the water in tank A. Thus, 
tank B would supply water to flash evaporator 
water supply system A and to the EMU fill in 
the airlock. If it is necessary to provide space 
for storing water in tank A and/or B, tank A 
and/or B water can be dumped overboard. 


An external airlock water transfer valve and 
line are installed in the orbiters. The valve and 
line could provide capability to transfer water 
from the orbiter's supply Н:О system to the 
International Space Station (ISS). However, there 
are no current plans to use this water transfer 
capability. This configuration is covered in more 
detail in the ODS section of this document. 


If the tank C or D outlet valve is opened, water 
from either tank is directed to the water outlet 
manifold. The water is then available to the flash 
evaporator B water supply. 


Supply Water Crossover Valves 


A crossover valve installed in the water outlet 
manifold is controlled by the SUPPLY Н20 
CROSSOVER УГУ switch on panel RI11L. 
When the switch is positioned to OPEN, the 
crossover valve opens and allows tank A or B 
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(also C or D) to supply both flash evaporator 
water supply systems A and B, the EMU fill in 
the airlock, and the water dump line. A talkback 
indicator above the switch indicates OP when 
the crossover valve is opened, barberpole when 
the valve is in transit, and CL when the valve is 
closed. The CLOSE position isolates the water 
manifold between the tank A and B outlets and 
the tank C and D outlets. 


Contingency Water Container Fill 
Configuration 


There is an additional supply H20 tank config- 
uration for ISS to transfer H2O to the ISS via 
contingency water container (CWC) bags. In 
this configuration, the tank A outlet is OPEN, 
the tank B inlet is CLOSED, and the XOVER 
valve is closed. The circuit breakers on ML86B 
that provide power to the tank B inlet and the 
XOVER valves are then pulled to preclude 
inadvertent valve opening. This configuration 
allows tanks A and В to be used for potable H:O 
transfer and tanks C and D to be used for FES 
operations. This configuration may remain a 
backup option if the supply НО transfer lines 
become operational on the ISS. 


Supply Isolation Valve 


Water from supply system А is routed directly 
to the flash evaporator. Water from system B is 
routed to an isolation valve in the system. The 
valve is controlled by the SUPPLY Н20 B SPLY 
ISOL VLV switch on panel R11L. When the 
switch is positioned to OPEN, water from 
supply system B is directed to the flash evap- 
orator. A talkback above the switch indicates 
OP when the valve is opened, barberpole when 
it is in transit, and CL when the valve is closed. 
The CLOSE position isolates water supply 
system B from the flash evaporator. 


Supply Water Dumps 


Supply water from all the tanks can be dumped 
overboard, if necessary, through a dump 
isolation valve and a dump valve. Supply water 
from tank C or D can also be dumped 
overboard, if necessary, through the crossover 
valve and through the dump isolation valve 
and dump valve. Тһе overboard dump 
isolation valve is located in the crew cabin, and 
the dump valve is located in the midfuselage. 
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Тһе dump isolation valve is controlled by the 
SUPPLY H20 DUMP ISOL VLV switch on 
panel R11L. The dump valve is controlled by 
the SUPPLY H20 DUMP УГУ switch on panel 
R11L. 


The SUPPLY H20 DUMP УГУ ENABLE/NOZ 
HTR switch on panel R11L must be positioned 
to ON to supply electrical power to the SUPPLY 
Н20 DUMP УГУ switch. The ON position also 
applies power to the nozzle heaters, which 
warm the nozzles to prevent freezing when the 
dump valve is opened. When the DUMP VLV 
and DUMP ISOL VLV switches are positioned 
to OPEN, the corresponding valve is opened, 
which allows supply water to be dumped 
overboard. A talkback indicator above each 
switch indicates OP when the corresponding 
valve is open, barberpole when it is in transit, 
and CL when it is closed. Closing either valve 
inhibits the dumping of supply water. At the 
completion of the dump, each switch is 
positioned to CLOSE to close the corresponding 
valve. The nozzle heater is then deactivated by 
placing the SUPPLY H2O DUMP МУ 
ENABLE/NOZ HTR switch to OFF. 
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H20 ИМЕ НТК Circuit Breakers on Panel ML86B 
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Contingency Crosstie 


There is a contingency crosstie connection in the 
supply water overboard dump line between the 
dump isolation valve and dump valve. There is 
a corresponding crosstie connection in the 
waste water overboard dump line between the 
dump isolation valve and dump valve. These 
crosstie connections permit joining the waste 
water system through a flexible hose to the 
supply water system for emergency dumping of 
waste water through the supply water dump 
nozzle (and vice versa). CWC bags are also 
filled through the contingency crosstie for 
emergency storage of supply or waste water. 
The CWC bags nominally hold 95 pounds оЁН:О 
and are stowed in the middeck for entry. 


Supply H50 Dump Line Purge Device 


Before beginning a supply НО dump, a purge 
device is installed in the supply H2O quick 
disconnect of the contingency crosstie. Тһе 
purge device allows cabin air at ~3 lb/hr to 
purge the supply ЊО dump valve of any 
remaining water droplets to preclude a 
condition known as “burping” of the dump 
valve. When the water droplets freeze under 
the dump valve, they expand and could cause 
the dump valve to open. Purging the valve post 
dump alleviates this problem. 


Dump Nozzle Heaters 


The supply water dump nozzle employs a 
heater to prevent freezing of the supply water 
dump nozzle at the midfuselage. The dump 
nozzle heater is powered when the SUPPLY 
H20 DUMP УГУ ENABLE/NOZ HTR switch on 
panel R11L is positioned to ON. When the 
switch is positioned to OFF, it removes electrical 
power from the nozzle heater, as well as the 
SUPPLY H20 DUMP УГУ switch, which causes 
the dump valve to close. 


The supply water line upstream of the water 
dump nozzle has electrical heaters on the line to 
prevent supply water from freezing. The A and B 
heaters on the line are thermostatically controlled 
and are powered by the H20 LINE НТК A and B 
circuit breakers on panel ML86B. (These circuit 
breakers also provide power to thermostatically 
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controlled heaters on the waste water line and the 
waste collection system vacuum vent line.) 


Ihe supply water feed lines to the flash 
evaporators are approximately 100 feet long. To 
prevent the water in the lines from freezing, 
redundant heaters are installed along the length 
of the water lines. The heaters are controlled by 
the FLASH EVAP FEEDLINE HTR A SUPPLY 
and B SUPPLY switches on panel L2. When a 
switch is positioned to 1, it enables the 
thermostatically controlled heaters on the 
corresponding supply line to automatically 
control the temperature on that line. When a 
switch is positioned to 2, it enables the redun- 
dant thermostatically controlled heater system 
on the corresponding supply line. The OFF 
position of each switch inhibits heater operation 
on the corresponding supply line. 
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FLASH ЕУАР FEEDLINE НТВ Switches 
on Panel L2 


Galley Water Supply 


The galley supply valve in the supply water line 
from the microbial filter of tank A permits or 
isolates the supply water from the galley or 
water dispenser. When the SUPPLY Н2О 
GALLEY SUP VLV switch on panel R11L is 
positioned to OPEN, supply water is routed 
through parallel paths: one path flows through 
the atmospheric revitalization system water 
coolant loop water chiller for cooling of the 
supply water, and the other path bypasses the 
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water chiller with ambient temperature water. 
A talkback indicator above the switch indicates 
OP when the valve is open, barberpole when 
the valve is in transit, and CL when the valve is 
closed. The CLOSE position of the switch 
isolates the potable supply water from the 
middeck ECLSS supply water panel. 
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GALLEY Water Supply Switch and Talkback 
on Panel R11L 


If the galley is not available or manifested for a 
flight, the chilled water and ambient water are 
connected to an Apollo water dispenser to 
dispense ambient and chilled water for drinking 
and food reconstitution. 


Waste Water System 


A single waste water tank receives waste water 
from the humidity separator and the waste 
management system. The tank is located 
beneath the crew compartment middeck floor 
next to the supply water tanks. 


The waste water tank holds 165 pounds of 
expellable water (plus 3.3 pounds residual), is 35.5 
inches long and 15.5 inches in diameter, and 
weighs 39.5 pounds dry. It is pressurized by 
gaseous nitrogen from the same source as the 
supply water tanks. 
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Waste water is directed to the waste water tank 
1 inlet valve, which is controlled by the WASTE 
H:O TANK 1 УГУ switch on panel ML31C. 
When the switch is positioned to OPEN, waste 
water is directed to the waste water tank. A 
talkback indicator above the switch indicates 
OP when the valve is open, barberpole when 
the valve is in transit, and CL when the valve is 
closed. Positioning the switch to CLOSE closes 
the waste water tank inlet, isolating the waste 
water tank from the waste water collection 
system. When the valve is open, waste water 
from the tank can also be directed to the waste 
water dump line for overboard dumping. The 
waste water tank 1 outlet valve (or drain valve) 
operates the same as the inlet valve. It is 
controlled by the WASTE H:O TK 1 DRAIN 
VLV switch on panel ML31C. The addition of 
the condensate quick disconnect (OD) required 
the humidity separator common outlet to be 
plumbed to the waste tank via the drain line. 
When the waste water outlet valve is OPEN, 
humidity waste will flow into the waste tank. 
During condensate collection, the outlet valve 
will be closed and humidity waste water will 
flow into a connected CWC bag to be disposed 
of later. This valve is also opened for ground 
draining of the tank. 


Waste Water Dumps 


The waste water dump isolation valve and waste 
water dump valve in the waste water dump line 
allow waste water to be dumped overboard 
through the waste water dump nozzle. Тһе 
WASTE H;O DUMP ISOL VLV switch on panel 
ML31C positioned to OPEN allows waste water 
to be directed to the waste water dump valve. A 
talkback indicator above the switch indicates OP 
when the valve is open, barberpole when the 
valve is in transit, and CL when the valve is 
closed. 


For waste water to be dumped overboard, the 
waste water dump valve must be opened. It is 
controlled by the WASTE H;O DUMP VLV 
ENABLE/NOZ HTR and WASTE H;O DUMP 
УГУ switches on panel ML31C. When the 
WASTE H;O DUMP VLV ENABLE/NOZ HTR 
switch is positioned to ON, electrical power is 
supplied to the waste water dump nozzle 
heaters апа the WASTE H;O DUMP УГУ 
switch. The heaters at the waste water dump nozzle 
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prevent waste water from freezing at the overboard 
dump nozzle. 


When the WASTE H:O DUMP УГУ switch is 
positioned to OPEN, the dump valve allows 
waste water to be dumped overboard. А 
talkback indicator above the switch indicates 
OP when the valve is open, barberpole when 
the valve is in transit, and CL when the valve is 
closed. Ш waste water is dumped overboard, 
the DUMP ISOL VLV switch is positioned to CL 
upon completion of the dump. The WASTE 
H30 DUMP VLV is positioned to CLOSE, and 
the WASTE НО DUMP УГУ ENABLE/NOZ 
HTR switch is set to OFF. 


CAUTION 


If the DUMP VLV ENABLE/NOZ HTR 
switch is positioned to OFF before the 
DUMP VLV switch is positioned to CLOSE, 


the dump valve will remain open and the 
heaters protecting the dump nozzle from 
freezing will be deactivated. 
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Тһе waste water dump line, upstream of the 
waste dump nozzle, has electrical heaters on the 
line to prevent waste water from freezing. The 
thermostatically controlled A and B heaters are 
powered by the ЊО LINE НТК A and В circuit 
breakers on ML86B. (These circuit breakers also 
provide power to thermostatically controlled 
heaters on the supply water line and waste 
collection system vacuum vent line.) 


Contingency Crosstie 


The contingency crosstie quick disconnect in the 
waste water overboard dump line between the 
dump isolation valve and dump valve permits 
waste water to be joined with the supply water 
system through a flexible hose for emergency 
dumping of supply water through the waste 
water dump or using waste water for the flash 
evaporators. 


Waste Water Tank Draining 


The waste water tank 1 drain valve controls the 
draining of the waste water tank during ground 
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operations through the ground support 
equipment flush and drain. When the WASTE 
Н:О TK 1 DRAIN УГУ switch on panel ML31C 
is positioned to OPEN, the valve permits the 
draining and flushing of the waste water tank. 
The drain line is capped during flight. А 
talkback indicator above the switch indicates 
OP when the valve is open, barberpole when 
the valve is in transit, and CL when the valve is 
closed. 


Operations 


Pressure Control System 


For ascent, both 14.7 psia cabin regulator inlet 
valves are closed to isolate the 14.7 psia cabin 
regulators. If a cabin leak develops, this 
configuration conserves nitrogen Бу пої 
allowing any makeup flow into the cabin until 
the cabin pressure drops below 8 psia. The О» 
regulator inlet valves are closed, directing all 
the О» to the О» crossover manifold to supply 
the launch and entry suit helmets. The О›/ № 
control valve on pressure control system 1 is 
open to allow № to pressurize the О» /№ 
manifold. The О›/ №» control valve on pressure 
control system 2 is closed. This would normally 
allow oxygen to flow to the О›/ №» manifold, 
but since the oxygen regulators are closed, 
nothing is configured to flow through the 
emergency 8 psia regulators on pressure control 
system 2. The crew will close the visors of their 
launch and entry suit helmets shortly before lift- 
off and breathe 100 percent О; until shortly after 
solid rocket booster separation. 


The pressure control system remains in the 
ascent configuration until early in the flight 
plan when the orbit pressure control system 
configuration is performed. Тһе pressure 
control system configuration to system 1 
typically is called for in the flight day 1 EZ 
activities block. The 14.7 psia cabin regulator 
inlet valve on the selected pressure control 
system is opened. This enables the cabin 
regulator to automatically maintain the cabin 
pressure at 14.7 psia. The О» regulator inlet 
valve is opened, and the selected system О›/ № 
control valve is taken to AUTO. This enables 
the О›/ М> controller to control whether О» or N2 
flows into Ње O2/N2 manifold based on cabin 
PPO, level. During late Flight Day 1 timeline 
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activities, the О» bleed orifice is installed in 
launch and entry helmet QD-8. The О; bleed 
orifice is sized based on number of crew and 
compensates for the crew’s metabolic O2 usage 
by flowing О; directly into the cabin. This helps 
keep the PPO, level stable when the cabin 
pressure is greater than 14.7 psia and the cabin 
regulators are not flowing. It also minimizes 
automatic switchovers of the ОуМ; controller and, 
in doing so, lessens the chances for annunciating an 
O» or N» high flow alarm. А reconfiguration to 
pressure control system 2 тау be performed 
halfway through the mission or post-undocking 
on flights to the ISS. 


A 10.2 psia cabin protocol was developed by the 
flight surgeons to minimize the risk of decom- 
pression sickness (bends) for crewmembers 
preparing for an EVA. The EVA crewmembers 
must prebreathe pure O» before they go EVA to 
help flush N» out of their body tissue. The 
following 10.2 cabin protocol options have 
been developed: 


e Option 1 


— 60-minute initial prebreathe on 
launch and entry suit helmet 


- 12 hours at 10.2 psia cabin pressure 


- 75-minute final prebreathe in suit 
* Option2 


— 60-minute initial prebreathe on 
launch and entry suit helmet 


- 24 hours at 10.2 psia cabin pressure 


- 40-minute final prebreathe in suit 
e Option3 
— 4-hour prebreathe in suit 


For scheduled EVAs, option 1 or 2 is chosen to 
minimize the in-suit prebreathe just prior to the 
EVA. The cabin is depressurized to 10.2 psia 
using the airlock depressurization valve located 
in the airlock. Because there is no 10.2 psia 
cabin regulator, the cabin pressure and the 
PPO»levels must be manually managed during 
10.2 psia cabin operations. 
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NOTE 


If a 10.2 depress is scheduled early in the 
mission, the PCS 1 configuration may be 
delayed until 10.2 operations are no 
longer required. This saves consumables 
during consumable-critical missions, such 
as ISS docking missions, where orbiter О» 
and № are used to repress and resupply 
the ISS. 


The pressure control system configuration is the 
same for entry as it was for ascent. 


Atmospheric Revitalization System 


The atmospheric revitalization system is 
already configured for ascent at crew ingress. 
One cabin fan, one humidity separator, one 
IMU fan, and one fan in each avionics bay are 
already operating. The cabin temperature 
control valve is positioned in the FULL COOL 
position by powering the controller and 
adjusting the rotary switch to the COOL 
position. Once the FULL COOL position is 
reached, cabin temperature controller 1 is 
unpowered. The humidity separators and the 
IMU fan signal conditioners are unpowered to 
protect against an AC to AC bus short, which 
could cause loss of a main engine controller. 
(The wire bundle that carries power to these 
signal conditioners had а short on 
SIS-6.) Water loop 2 is on, and water loop 1 is 
off during ascent. Both water bypass valves are 
positioned to flow approximately 950 Ib/hr 
through the Freon/ water interchanger. 


If no failures occur during ascent, no actions are 
required to manage the atmospheric revital- 
ization system in OVs 103 and 104 (OV-105 if 
flown without the RCRS), with the exception of 
scheduled LiOH canister changeouts. During 
the post insertion period for RCRS configured 
vehicles, the crew will activate the system. 
Every 13 minutes, the RCRS will automatically 
switch chemical beds between regeneration and 
adsorption as part of a 26-minute full 
regeneration cycle with no further crew actions 
for nominal operations. Mid-mission (on 10+ 
day flights), the activated charcoal canister will 
be changed out. Additionally, during deorbit prep 
for RCRS configured vehicles, the crew will replace the 
ШОН canister, and deactivate the RCRS. The 
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operating cabin fan(s) should be turned off for 
removal and installation of LiOH and charcoal 
canisters. 


The orbit fan and pump configuration is the 
same on orbit as for ascent, except water loop 1 
is set to the GPC position and the BYPASS 
controller for water loop 2 is set to the AUTO 
position. While in SM OPS 2, the GPC position 
enables the inactive water loop to be cycled on 
periodically. This periodic cycling prevents the 
inactive water loop from freezing. The cycling 
sequence is initiated any time an OPS transition 
is made into SM OPS 2. When an OPS 
transition is made, the pump will receive a 6- 
minute ON command, then remain off for 4 
hours. The pump will nominally cycle on for 6 
minutes every 4 hours. 

The pump on water loop 2 is powered by AC3 
when its switch is in the ON position. The GPC 
position of the WATER PUMP LOOP 2 switch 
provides an alternate power source for the 
pump during ascent and entry. When the BFS 
computer has control of the payload MDMs, the 
GPC position powers the loop 2 pump with 
АСІ power. Since water loop 2 has only one 
pump, this enables the pump to remain 
powered even if AC3 should fail. However, the 
circuit breakers that provide АС1 power to the 
GPC position of Н:О loop 2 and the A pump of 
Н:О loop 1 are nominally pulled for the entire 
mission. This is because of the possibility of an 
AC1-to-AC3 short as a result of a relay failure 
or switch failure. If power is required for the 
pump to operate, these circuit breakers will 
need to be pushed in. The GPC position of the 
WATER LOOP 1 PUMP switch has no special 
function during ascent and entry; it acts just like 
the OFF position. 


If the situation arises where no PASS SM or BFS 
computers are available, the water loop pumps 
can still be commanded on in the GPC position 
using real-time commands. Тһе real-time 
commands can be issued by a ground uplink or 
crew inputs on DPS UTILITY SPEC 1. The real- 
time commands must be issued through the 
computer that has control of the payload 
MDMs. It would take a severe loss of system 
redundancy for the use of real-time commands 
to ever be required. 
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Cooling Management 


Depending on the mission phase, the Freon 
cooling loops are cooled four different ways. 
Prior to launch, cooling is provided by the 
ground support equipment. After lift-off, there 
is no active means of cooling until about the time 
of solid rocket booster separation. It takes the 
orbiter slightly more than 2 minutes to reach an 
altitude where water evaporation provides 
effective cooling. Until that time, sufficient 
“thermal inertia” is in the Freon loops to limit 
the temperature increase so that no active heat 
rejection is required. 


At solid rocket booster separation, the flash 
evaporator system receives a GPC ON 
command from the BFS and begins providing 
active cooling. The FES continues to be the 
primary cooling source through the ascent 
phase and on into the post insertion timeframe. 
During the Post Insertion checklist procedures, 
flow is initiated through the radiators, the 
payload bay doors are opened, and the 
radiators become the primary source of cooling. 
The topping FES may be left on to provide 
supplemental cooling when necessary. If the 
orbiter is in a warm attitude, the radiator panels 
may not be effective enough to provide the 
desired cooling. The FES can provide the 
additional cooling necessary to achieve the 
desired Freon loop temperatures. 


During the deorbit prep procedures, the radiators 
are cold soaked for use later during entry. The 
radiator coldsoak process stores cool Freon in the 
radiator panels. This is accomplished by 
changing the radiator control temperature set 
point from NORM to HI (38° to 57° Е). The FES is 
reactivated to cool the Freon loops from 57° to 
39° F. Since less cool Freon from the radiator 
panels is required to achieve the 57? Е RAD OUT 
temperature, the Freon stays in the radiator 
panels longer and becomes even cooler. After 
being in this configuration for a little over an 
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hour, the radiators are bypassed, and the FES 
begins providing all the cooling. The FES 
provides the cooling during the rest of the 
deorbit, through entry interface, and on down to 
about V = 12k (approximately 175,000 ft). Below 
100,000 ft, the atmospheric pressure is too high for 
the FES to cool effectively. At V = 12k, the 
radiator controllers are activated and put through 
their auto startup sequence, and radiator flow is 
reinitiated to utilize the stored Freon coldsoak. 
Normally, the radiator coldsoak is used as the 
primary source of vehicle cooling from this point 
through rollout. 


Once the radiator coldsoak is depleted, the 
ammonia boilers are used as the primary 
cooling source until the ground support 
equipment cooling cart hookup is complete. 
Then the ammonia cooling is deactivated, and 
ground support equipment cooling is initiated. 


For ascent aborts, the thermal management of 
the Freon cooling is somewhat different. The 
FES still provides the cooling after solid rocket 
booster separation. The cooling management 
during the entry portion changes. The ammonia 
boilers provide the cooling during the lower 
stages of the abort entry. The ammonia is used 
for cooling during the entry phase of an ascent 
abort because the orbiter lifts off without a 
radiator coldsoak, and the FES functions 
normally only at low atmospheric pressure 
(above 100,000 ft). 


For a transoceanic abort landing (TAL) or an 
abort once around (AOA), the ammonia boiler 
receives a GPC “ON” command from the BFS at 
MM 304 and 120,000 ft. For a return to launch 
site abort, the ammonia boiler receives a GPC 
“ON” command from the BFS at external tank 
separation (MM 602). The ammonia boiler will 
provide the cooling from this point through 
landing. The ammonia boilers can provide 
cooling for approximately 30 to 40 minutes under 
ascent abort conditions. 


2. SYSTEMS 


USA007587 


Rev. A 


ECLSS Caution and Warning Summary 


e The red CABIN ATM caution and warning ° 

light on panel F7 is illuminated for any of the 
following monitored parameters: (1) cabin 
pressure below 13.76 psia (13.74 psia for 
OV-104) or above, 15.36 psia for OV-103, 
15.53 psia for OV-104, and 15.35 for OV-105, 
(2) РРО: below 2.7 psia or above 3.6 psia, 
(3) oxygen flow rate above 4.9 pounds per 
hour, and (4) nitrogen flow rate above 4.9 
pounds per hour. 


The yellow AV BAY/CABIN AIR C/W light 
will illuminate for the following conditions: 
any avionics bay temperature higher than 
130° F, the heat exchanger out temperature 
higher than 145° F, or cabin fan delta P below 
4.16 inches of water or greater than 6.8 
inches. 


The yellow Н:О LOOP C/W light will illumi- 
nate if the outlet pressure of water coolant 
loop pump 1 is less than 19.5 psia or greater 
than 79.5 psia, or if pump 2 pressure is less 
than 45 psia or greater than 81 psia. 


The yellow FREON LOOP light will illumi- 
nate if Freon flow in either coolant loop is 
less than 1186 Ibm/hr, or if either loop’s Evap 
Out Temperature is less than 32.2° F or 
greater than 64.8° F (upper limit for ascent is 
115° Е.) 
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ECLSS Summary Data 


The functions of the ECLSS are to maintain 
the orbiter’s thermal stability, provide a pres- 
surized, habitable environment for the crew 
and onboard avionics, and store water and 
liquid waste. 


The four components of the ECLSS are the 
pressure control, atmospheric revitalization, 
active thermal control, and supply and waste 
water systems. 


The pressure control system pressurizes the 
crew cabin at 14.7 psia, pressurizes the sup- 
ply and waste water tanks, and provides 
breathing oxygen directly to the launch and 
entry suit helmets, and emergency breathing 
masks. 


The main components of the pressure control 
system are oxygen and nitrogen systems, 
tanks, and valves. 


The atmospheric revitalization system circu- 
lates air through the crew compartment to 
control relative humidity between 30 and 65 
percent, maintain carbon dioxide and carbon 
monoxide at non-toxic levels, air filtration, 
control temperature and ventilation in the 
crew compartment, and provide avionics 
cooling. The water loop provides cooling for 
the crew and avionics. 


The atmospheric revitalization system con- 
sists of cabin air loops, water coolant loops, 
fans, and heat exchangers and interchang 
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The active thermal control system provides 
orbiter heat rejection during all phases of the 
mission. 


The active thermal control system consists of 
two complete, identical Freon coolant loop 
systems, cold plate networks for cooling avi- 
onics units, liquid/liquid heat exchangers, 
and radiators, flash evaporators, and ammo- 
nia boilers. 


The supply water system stores water 
generated by the fuel cells. The supply water 
is used for flash evaporator system cooling, 
crew consumption, and hygiene. 


The waste water system stores waste from 
the crew cabin humidity separator and from 
the crew. 


Four supply water tanks and one waste 
water tank are located beneath the crew 
compartment middeck floor. 


Panels that control the major portion of 
ECLSS functions are panels L1, L2, MO10W, 
and R11L. Panels ML31C, ML86B, MA73C, 
R13L, МОРЕ, and MD44F also control 
ECLSS functions. 


ECLSS status can be monitored on panel O1 
and on the following DPS displays: ENVI- 
RONMENT (DISP 66), SM SYS SUMM 1, SM 
SYS SUMM 2, APU/ENVIRON THERM 
(DISP 88), and ВЕБ THERMAL. 
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ECLSS Rules of Thumb 


NOTE 


Numbers presented here are for 
typical orbit power and heat loads 
and тау vary significantly, 
depending on attitude and power 
loading. 


® Supply water tanks fill at about 6.5 percent 
per hour, depending on fuel cell load (14 kW 
typical orbit power load * 0.77 lbm/hr/kW + 1.65 
Ibm per 96). 


Waste water tank fills at about 4.4 percent per 
day per crewmember (urine and condensed 
humidity). Relative contributions from urine and 
condensate are about equal. 


e Assuming no concurrent fuel cell water 
replenishment, supply water tanks empty at 
about 90 percent per hour for a water dump 
(or, about 40 seconds per percent to dump); 
about 40 percent per hour when using full-up 
FES (high load and topping evaporator) for 
cooling with payload bay doors closed, and 
about 15 percent per hour when using the 
FES topping evaporator for supply water 
dumps on orbit with the doors open. 


Waste water tank empties at about 2 percent per 
minute. 


On-orbit cold soak is good for about 15 
minutes of cooling. Prelaunch Freon 
conditioning is good for 2 to 3 minutes of 
cooling. 


Each ammonia boiler supply is good for about 
25 to 35 minutes of ground cooling. 


A single LiOH canister is usable for about 48 
man-hours. 


Typical nitrogen usage rate is about 6 lbm per 
day (assuming 7 crewmembers, at 14.7 psia). 


All of the ECLSS parameters visible on the panel 
O1 meters come from the same sensor that can be 
read on the display. They are not redundant and 
the meter/display pair cannot be used as 
confirming cues for a reading. 
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2.10 ESCAPE SYSTEMS 
CONTENTS 

Description 

Launch Pad Egress Systems 
Advanced Crew Escape Suit 
Parachute Harness and Parachute 


Cabin Vent and Side Hatch Jettison ... 210-12 


Egress Pole System. 

Emergency Egress Slide 

Overhead Escape Panel 

Procedures for Bailout, Water Survival, 
and Rescue 


Vehicle Loss of Control/Breakup 
Escape Systems Summary Data 


Description 


Escape systems refer to equipment and systems 
intended to facilitate emergency and contin- 
gency egress of the flight crew. Escape systems 
include equipment worn by the crewmembers, 
hardware built into the orbiter, and external 
systems located on the launch pad. Types of 
escape or emergency egress from the orbiter 
depend upon the mission phase (basically 
prelaunch, in-flight, and post-landing). The 
prelaunch phase implies the crew must perform 
an emergency egress while the orbiter is still 
positioned on the launch pad. 


The in-flight phase requires that the crew can 
safely bail out of the orbiter during controlled 
gliding flight at altitudes of 30,000 feet and 
below. A special in-flight crew escape system is 
devised for this phase. It includes pressure 
suits, oxygen bottles, parachutes, life rafts, 
pyrotechnics to vent the cabin and jettison the 
orbiter side hatch, and an escape pole to allow 
the crewmembers to clear the vehicle. The most 
likely uses of the system would be during a 
return-to-launch-site (RTLS) abort, transatlantic 
abort landing (TAL), or abort once-around 
(AOA) when the orbiter has insufficient energy 
to achieve a runway landing or after an 
emergency deorbit made regardless of landing 
site opportunities. 


During the post-landing phase, the crew exits the 
orbiter following an emergency landing or 
landing at a contingency site. The orbiter will 
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probably not survive a water ditching; therefore, 
bailout is the primary escape mode over water. 


The orbiter-based hardware associated with the 
in-flight crew escape system was installed after 
the Challenger accident. Some orbiter modifica- 
tions were required for the inclusion of the in- 
flight escape system. The side hatch water 
coolant lines for side hatch thermal 
conditioning were modified to accommodate 
the installation of the pyrotechnic separation 
system. The flight crewmembers' seats were 
also modified to accommodate the crew's 
altitude protection system suit. In addition, a 
handhold was added in the middeck next to the 
side hatch to permit the crewmembers 10 
position themselves through the side hatch 
opening for bailout. The interdeck access ladder 
was widened, and a handhold was added to the 
commander's seat to allow easier movement 
through the interdeck access. 


Software adjustments were also required to 
accommodate the in-flight escape system. Soft- 
ware changes applied to the primary avionics 
software system for OPS 3 and 6. The changes 
enable an automatic flight control mode of the 
orbiter with input by crewmembers by using 
the ATO abort position on the abort rotary 
switch in MM 603/305. The automatic mode 
stabilizes the orbiter by controlling the velocity 
and angle of attack to the desired bailout 
conditions, thus allowing the commander to 
escape. 


Launch Pad Egress Systems 


In the event of a potential catastrophe on the 
launch pad, escape by the flight crew is 
facilitated by descending to a safe area via 
slidewire baskets. The emergency egress/ 
escape system uses seven separate slidewires 
and seven multi-person basket assemblies to 
effect rapid escape of personnel from the 
195-foot level of the fixed service structure to a 
landing zone. The landing zone is 
approximately 1,200 feet west of the fixed 
service structure. The flight crew leaves the 
slidewire baskets and proceeds to the bunker, 
which is provided with breathing air, first aid 
supplies, and communications equipment. The 
flight crew will only leave the bunker upon 
instructions by the NASA Test Director. 
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Launch Pad Emergency Egress System 


An M-113 is positioned near the slidewire 
termination area. Тһе M-113 is a military 
armored personnel carrier designed to provide 
protected evacuation from the launch pad area. 


There are four modes of escape from the launch 
pad area, varying in degrees of egress aid to the 
crew by the closeout crew or pad fire/rescue 
crew. In the case of an aided escape, support 
crews are responsible for opening the side hatch 
using an emergency hatch opening tool. 


The launch pad structure also includes an 
escape temperature and hydrogen fire-hazard 
monitoring system, consisting of 10 temperature 
sensors and 14 ultraviolet (UV) hydrogen fire 
detectors. Nine UV fire detectors are located in 
the area of the white room, the orbiter access 
arm, and the fixed service structure both above 
and below the fire barrier. Five UV fire 
detectors are also spaced vertically down the 
fixed service structure from the 175-foot level to 
the 95-foot level to view a profile of the orbiter. 
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The 10 temperature sensors are located along 
the egress path, from the white room to the 
slidewire basket embarkation area. The sensors 
are placed both above and below the fire 
barrier. Тһе signals from these sensors are 
displayed on firing room console C-7 in the 
launch control center. 


The Firex spray system provides a water 
shower to the orbiter access arm and the fixed 
service structure in the event of a fire. There are 
20 water spray nozzles located on the orbiter 
access arm, approximately 4 feet above the 
walkway, and 20 on the fixed service structure, 
7 to 10 feet overhead. Each nozzle emits 287 
gallons of water per minute. Two control 
modes, local and remote, operate the Firex 
spray system. The local mode consists of two 
pairs of activation paddles located outside the 
white room on the orbiter access arm and on the 
east side of the elevators directly facing the 
orbiter access arm. The remote mode is a hard- 
wire backup control panel located in the launch 
control center. 
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Advanced Crew Escape Suit 


The advanced crew escape suit (ACES) is 
designed to provide protection to each 
crewmember for the following off-nominal 
conditions: 


e Loss of cabin pressure 

e Environmental extremes 

e Effects of prolonged zero gravity 
е Contaminated atmosphere 


The ACES has an inner pressure bladder that 
encompasses the crewmember’s body and an 
outer covering. The outer covering is an orange 
Nomex material that is heat/ flame resistant and 
provides a highly visible target for search and 
rescue (SAR). The pressure bladder 15 
constructed of Gore-Tex that wicks body 
moisture and vapor away from the 
crewmember when unpressurized, yet holds 
pressure when inflated. The ACES is designed 
to provide pressure protection indefinitely for 
total loss of cabin pressure or above 100,000 
feet. 


The ACES is a full-pressure suit that applies 
static pressure evenly to the entire body surface. 
Suit pressure is automatically maintained by a 
dual suit controller and, at full inflation, 
provides an absolute pressure of 3.67 psia. Suit 
pressurization begins when the cabin pressure 
altitude rises to around 35,000 feet and is “hard 
pressed” (3.67 psia) above 60,000 feet. Ground 
testing of the dual suit controller is through the 
“Dial-to-Test” and “Press-to-Test” manual 
controls. For either manual or automatic 
pressurizations, several ACES components 
must be properly attached. 


Detachable gloves are required for the ACES 
suit to properly provide pressure protection. 
The gloves attach to the sleeves via metal- 
mating rings. The rings provide an airtight seal 
and allow the gloves to swivel for improved 
mobility. Similarly, a mating-metal ring is 
provided for the helmet. 


The ACES helmet provides а pressurized 
breathing volume and head protection to the 
crewmember. A clear, rotating pressure visor is 
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used to seal the helmet cavity for the 
crewmember's face. Also, an independently 
mounted sunshade can be rotated as required. 
Another component is the antisuffocation valve 
located at the lower right rear of the helmet. If 
the oxygen supply is lost, inhalation by the 
crewmember will open the valve, allowing 
ambient air into the helmet. The helmet also 
provides an interface for communications 
between the communications carrier assembly 
(CCA) and the orbiter. 


The CCA, or comm cap, contains all necessary 
equipment for crewmember voice communi- 
cation. The comm cap contains dual/redundant 
microphones and dual/redundant earphones. 
All comm hardware is connected with comm 
cables and pass throughs. The ACES also has a 
pass through for several other reasons. 


A bioinstrumentation pass-thru (BIP) is located 
on the upper right leg allowing medical lines 
and/or water cooling lines to pass into the suit 
for the crewmember. Crewmembers require 
cooling for personal comfort while wearing the 
ACES and receive it from an external source. 


WARNING 


For the ACES to pressurize, gloves must be 


worn, helmet pressure visor must be 
down/ locked, and ВІР plug must be seated 


properly. 


Each crewmember relies on a closed water loop 
system to provide personal cooling. Water is 
cooled in the core of the individual cooling unit 
(ICU), mounted on crewmembers’ seats, using a 
thermoelectric principle. From the ICU, the 
water is pumped through water lines into the 
ACES via the BIP. The cooled water then 
circulates throughout tubes sewn into a liquid- 
cooled garment (LCG), worn under the ACES. 
The water returns back through the BIP to the 
ICU, where it begins the cycle again. Another 
item crewmembers wear under the ACES is the 
anti-g suit. 


Each crewmember is issued an anti-g suit to be 
worn during shuttle reentry and landing. The 
anti-g suit, or g-suit, is designed to counteract 
the effects of orthostatic intolerance due to body 
fluid loss by applying mechanical pressure to 
the lower abdomen and legs. 
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Advanced Crew Escape Suit (ACES) 


Inflation of the g-suit is controlled at the О» d. 


manifold/g-suit controller (опе piece), 
located on the upper left leg. This assembly 
consists of the following components, 
referenced to the illustration on the next page: 


а. А male О» hose fitting that connects 
to the orbiter О» supply hose. It is 
provided with a breakaway fitting 
to facilitate rapid egress from the 
vehicle. 


b. A second male О» hose fitting that 
connects the manifold with the 
emergency Оз bottles in the 
crewmember's parachute harness. 


с. А third (threaded) male О» hose 
fitting that connects the manifold 
with the oxygen regulator for 
crewmember respiration. 
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When the manifold is connected to 
orbiter О», rotating the g-suit dial 
(knurled knob) clockwise, inflates 
the g-suit bladders 0.5 psi per 
complete turn, to a maximum 
pressure of 2.5 psi. A one-way 
valve inside the manifold prevents 
the g-suit from inflating with 
emergency О», which is reserved for 
breathing. Rotation of the knob 
counterclockwise will deflate the g- 
suit bladders 0.5 psi per complete 
turn. Each complete revolution of 
the knob is indicated by a slight 
detent. The recommended setting 
for inflation is 1.5 psia, which is 
obtained by rotating the red knurled 
knob three complete turns 
clockwise. 
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e. When the g-suit controller clip is 
pulled free, the current volume of O2 
will be trapped maintaining g-suit 
pressure. Reinstallation of the clip 
will allow a normal deflation of the 
g-suit bladders. 


Parachute Harness and Parachute 


The parachute harness contains an interwoven 
system of nylon straps that attach the personal 
parachute assembly (PPA) to the crewmember. 
These straps provide complete body support for 
crewmembers during bailout, emergency 
egress, and rescue operations. In addition to the 
support straps, the harness also includes the 
following items that may prove necessary in an 
emergency: 


1. The emergency oxygen system (EOS) 
consists of two high-pressure 
cylinders containing ^ breathing 
oxygen. Regulators reduce the 3000 
psi pressure of the bottles to a 
working pressure of 70 psi A 
common manifold delivers oxygen 
from the bottles to the О; manifold/g- 
suit controller. The EOS is activated 
by a "green apple" on the right side of 
the harness. Once activated, the EOS 
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can supply a total of 401 liters of 
oxygen at 14.7 psi. At 38 liters per 
minute, the EOS will last for at least 
10 minutes at sea level and longer at 
high altitudes. 


A locking carabiner is attached to the 
left side of the harness. It is an oval 
aluminum ring for attaching descent 
devices used during роз алате 
emergency egress. It can also be used 
during rescue operations. 


A life preserver unit (LPU) encircles 
the crewmember's upper torso. Ї 
inflates automatically via two CO» 
cartridges (FLU-8) when submersed in 
water. It may also be inflated 
manually via two inflation toggles on 
the front of the harness. The unit is 
designed to keep an unconscious 
crewmember's head out of the water. 


Sixteen individual packages contain 
two liters of emergency drinking 
water and are stored at the rear of the 
harness. 


SHOULDER STRAPS 


' GREEN APPLE 
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Harness Diagram 


The PPA is an integrated pack assembly 
containing parachutes, risers, and actuation 
devices required for automatic and manual 
deployment of the parachutes. The PPA also 
contains survival equipment in the form of a 
personal life raft and personal locator beacon. 
Finally, the PPA doubles as a seat back cushion 
and is already in the orbiter when the crew 
ingresses prior to launch. During seat strap-in, 
the insertion technicians attach the PPA to the 
harness. 


There are four connections between the PPA 
and the harness; two riser attach fittings (Frost 
fittings) and two ejector snaps. During an 
inflight bailout, the crewmember will egress the 
seat, taking the parachute with him/her. When 
immersed in salt water, two Seawater Activated 
Release System (SEAW ARS) units, one for each 
riser, automatically release the risers and 
canopy from the harness. For a ground egress, 
the crewmember manually releases the four 
PPA attach points leaving it in the seat. The 
PPA contains the following items: 
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Automatic and manual pilot chute 
deployment system 


Drogue chute release knob 

An 18-inch-diameter pilot chute 

A 4.5-foot-diameter drogue chute 
A 26-foot-diameter main canopy 
Deployment sleeve 

Automatic actuation device (AAD) 
Life raft compartment 

Life raft 


SARSAT personnel locator beacon 
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For an in-flight bailout, crewmembers would 
use the primary parachute deployment 
sequence. First, crewmembers connect the 
extraction bridle to a lanyard on the crew 
escape pole. As the crewmember descends 
down the escape pole, the extraction bridle is 
fully extended initiating the auto sequence. 
After a 1.5 second delay, the bridle/lanyard are 
separated from the PPA via two heavy-duty 
pyrotechnic line cutters. Next, the upper flap of 
the PPA is opened when two light-duty line 
cutters release the spring-loaded pilot chute. 
The  18-inch-diameter pilot parachute 
immediately pulls out the drogue deployment 
sleeve. 
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The 4.5-foot-diameter drogue chute stabilizes 
the crewmember in a preferred attitude to 
reduce injury during freefall, and reduce 
parachute opening deployment damage. When 
the drogue chute is deployed, the AAD is 
armed. 
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The AAD is a pressure-activated pyrotechnic 
device with an internal aneroid that is sensitive 
to atmospheric pressure. When the AAD senses 
a pressure altitude of 14,000 + 1,000 feet, the 
pyrotechnic charge releases the drogue chute, 
which pulls the main parachute canopy out of 
the pack. 


The main parachute is a modified version of the 
Navy 26-foot conical canopy with Kevlar 
reinforcement. A discard line reefing system is 
added to increase the basic strength and reduce 
the load to the crewmember during opening 
shock. Four anti-oscillation windows are added 
at the base of the canopy to reduce oscillation 
during descent. The canopy is attached to the 
risers by 22 suspension lines. 


NOTE 


The parachute is not steerable. 


The average descent rate for a crewmember 
under main canopy is 24-ft/sec. 


Manual activation can be accomplished by 
pulling the ripcord handle on the upper left 
riser. Pulling the ripcord handle performs the 
same function as the bridle activation by firing a 
single light duty pyrotechnic cutter, which then 
deploys the pilot chute. The ripcord handle 
would be used if the bridle activation failed or 
the escape pole was not used. The drogue chute 
release knob is also located on the left parachute 
riser. 


The drogue chute release knob is used if the 
AAD fails to deploy the main canopy. Pulling 
the drogue chute release knob disconnects the 
drogue chute riser from the PPA, allowing it to 
deploy the main canopy. 


WARNING 


The drogue chute release knob will not 


deploy the main canopy unless the drogue 


chute has been deployed ма the 
bridle/lanyard or the ripcord handle. 


For auto or manual main canopy deployment, 
the Search and Rescue Satellite Aided Tracking 
(SARSAT) personnel locator beacon will be 
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Parachute Pack (Side) 


The SARSAT beacon is activated during main 
canopy deployment. A magnetic plug, pulled 
out by the canopy riser, activates the SARSAT 
beacon and begins transmitting during crew- 
member descent. The beacon has a range of 60 
miles to aircraft at a 10,000-foot altitude. The 
main canopy also fires two redundant light- 
duty pyrotechnic cutters, loosening the bottom 
of the PPA where the liferaft is located. 
However, the liferaft remains stowed in place 
during descent until water entry. 


The polyurethane coated nylon life raft 
automatically inflates upon immersion in water. 
If required, a manual inflation lanyard is also 
installed on the left side of the PPA. Once 
inflated, the life raft is attached to the PPA with 
a 64-inch tether to keep it within reach of the 
crewmember. The raft is also equipped with 
two sea dye markers, a sea anchor, a bailing 
pump, and a bailing cup. Each crewmember 
also carries survival gear, located in both of the 
lower leg pockets of the ACES. 


The survival gear includes a PRC-112 survival 
radio, a strobe light, a pen-gun flare kit, a 
day/night flare, a signal mirror, two 12-hour 
stick chem-lights, and motion sickness pills. 


activated апа the Шегай compartment 
loosened. 
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Emergency Crew Module Depressurization and Side Hatch Jettison T-Handles 


Cabin Vent and Side Hatch Jettison Separate T-handle initiators, located on the 
forward port middeck floor, activate the cabin 


The cabin vent system and hatch jettison system vent and hatch jettison systems. The T-handles 
allow the flight crew to quickly and safely аге located inside a pyro box accessible to the 
egress the orbiter during emergency situations. crewmember seated in seat 5. Squeezing 
The cabin vent system consists of pyrotechnics together two latches on the top opens the pyro 
and valves that let the crew quickly box. A safing pin is used to secure the box 
depressurize the crew cabin to ambient pressure during orbit operations. Pre-launch and prior 
prior to hatch jettison during bailout. to deorbit, the pin is removed. Reinstalling the 
Depressurizing the cabin prevents it from PiN safes the side hatch. 

structural buckling during hatch jettison. The 

hatch jettison pyrotechnic system ejects the NOTE 

hatch from the orbiter, allowing the crew to bail 


: А у The convoy crew will not approach the 
out or rapidly egress the orbiter after landing. 


orbiter unless the crew has reported the 
“side hatch safed.” 

NOTE 

The pyro vent valve is activated by squeezing 
and pulling the aft T-handle. The pyro vent 
valve opens a 15-square-inch hole between the 
crew compartment and the payload bay. The 
purpose of the valve is to depressurize the cabin 
at a controlled rate prior to jettisoning the side 
hatch in flight. This is necessary to prevent 


The pyrotechnics systems use mechanical 
energy transfer systems and do not 
require orbiter electrical power. 
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severe buckling of the middeck floor, which 
would occur if the side hatch were jettisoned 
without any attempt to equalize the inside and 
outside pressure. Pyro vent valve initiation at 
an altitude of 40,000 feet requires approximately 
75 seconds to lower the pressure in the cabin to 
that of the ambient air outside the orbiter. 
Equalization occurs at approximately 31,000 
feet. 


WARNING 


The cabin vent pyros are an ignition source 


in the payload bay and should not be used 
for post-landing egress. 


Three separate sets of pyrotechnics are 
associated with the side hatch, all of which are 
activated simultaneously by squeezing and 
pulling the forward T-handle. A total of four 
linear-shaped charges (two per hinge for 
redundancy) cut through hinge arms near the 
side hatch. Two (redundant) expanding tube 
assemblies are included to fracture the 70 
frangible bolts that hold the hatch adapter ring 
to the orbiter. Three (partially redundant) 
thruster packs are used to separate the hatch 
from the orbiter at a velocity of approximately 
45 ft/sec. The hatch jettison features could be 
used in a landing emergency. 


Egress Pole System 


The crew escape pole is designed to guide 
escaping crewmembers on a trajectory that will 
clear the vehicle's left wing when bailing out of 
the orbiter. The escape pole consists primarily 
of a curved, spring-loaded, telescoping steel 
and aluminum cylinder. The escape pole is 
contained in an aluminum housing that attaches 
to the middeck ceiling and side hatch tunnel 
area. A magazine holding eight lanyards is 
attached to the port end of the pole housing 
near the side hatch tunnel. The lanyards are the 
means by which crewmembers are guided 
down the pole. 
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Crew Egress/Wing Clearance 


Each lanyard assembly consists of a hook 
attached to a Kevlar strap that surrounds the 
escape pole. Four roller bearings on each strap 
surround the pole and permit the lanyard to roll 
freely down the pole. The Kevlar thread 
stitching сап break away, providing the 
crewmember with an energy absorber. Тһе 
crewmember slides down the escape pole and 
off the end directing him/her beneath and away 
from the vehicle. 


Emergency Egress Slide 


The emergency egress slide provides a rapid 
and safe orbiter egress during post landing 
contingency and emergency situations. The 
slide allows the safe egress of the crewmembers 
to the ground within 60 seconds after the side 
hatch is fully opened or jettisoned. It also 
accommodates the egress of incapacitated 
crewmembers. Equipment consists of ап 
inflatable slide, pressurized Argon bottle, 
aspirator, girt bracket, and slide cover, all 
stowed together below the side hatch. 


The slide can be deployed by attaching it to the 
side hatch if the hatch has not been jettisoned or 
rotating the slide into the opening if the hatch 
has been jettisoned. The slide is inflated by 
pulling a lanyard that activates an Argon bottle 
pressurized to 3,000 psi. The slide inflates to 
approximately 2.75 psig. A relief valve bleeds 
off pressures greater than 3.0 psig. 
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Overhead Egress Window Jettisoned 


Overhead Escape Panel 


In the event that egress through the side hatch is 
not possible, the port side flight deck overhead 
window (window 8) provides the flight crew 
with a secondary emergency egress route. This 
overhead window consists of three panes of 
glass, two panes attached to the crew compart- 
ment and one attached to the upper forward 
fuselage. The overhead window jettison system 
consists primarily of expanding tube 
assemblies, mild detonating fuses, frangible 
bolts, and associated initiators. 


Pulling the ring handle located forward of the 
flight deck center console (C3) activates the 
overhead window jettison system. When initi- 
ated, the outer pane is jettisoned upward and 
aft. A time delay in the pyrotechnic firing 
circuit delays the initiation of the opening of the 
inner pane 0.3 second after the outer pane is 
jettisoned. The inner window pane rotates 
downward and aft into the crew compartment 
aft flight deck on hinges located at the aft 
portion of the window frame. A capture device 
attenuates the opening rate and holds the 
window in position. This overhead window 
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jettison system can also be initiated by 
ground personnel from the outside of the 
orbiter on the starboard side of the forward 
fuselage. 


Crewmembers use the MS2 seat (seat 4) to 
climb up through the window. Seven 
emergency ground descent devices (Sky 
Genies) are stowed on the overhead aft 
flight deck outboard of each overhead 
window, one for each flight crewmember. 
The emergency ground descent device 
enables crewmembers to lower themselves 
to the ground over the starboard side of the 
orbiter. 


Procedures for Bailout, Water Survival, 
and Rescue 


When it is determined that a bailout is 
necessary, the commander places the orbiter 
in a minimum-sink-rate attitude and 
engages the autopilot. At 50,000 feet, the 
commander directs the crew to close and 
lock their visors and activate emergency 
oxygen. At 40,000 feet, MS 3 (seated 
middeck in seat 5) vents the cabin via the 
pyro vent valve T-handle initiator. At an 
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altitude of 31,000 feet the cabin pressure is 
about equalized with the outside atmosphere. 
Shortly thereafter, the commander directs MS3 
to jettison the side hatch. As soon as the hatch 
is jettisoned, all crewmembers disconnect their 
oxygen and communication connections, and 
egress their seats. 


MS3 deploys the egress pole by pulling the 
safing pin and arming pin and rotating the 
handle counterclockwise. Should the pole fail 
to deploy fully, the manual ratchet is used to 
manually extend the pole. The exit involves 
each crewmember attaching the lanyard hook 
assembly to the parachute harness and egress- 
ing through the side hatch opening. It takes 
approximately 2 minutes for a maximum crew 
of eight to bailout. 


As each crewmember exits the orbiter, the force 
exerted by entering the windstream activates the 
automatic parachute sequence. Once the 
crewmember is off the pole and away from the 
orbiter (1.5 second delay), a pyrotechnic cutter 
separates the bridle and lanyard. The 18-inch pilot 
chute is deployed 1.5 seconds later, and 
immediately deploys the 4.5-foot drogue chute. 
The drogue chute stabilizes the crewmember 
down to an altitude of 14,000 feet, then deploys 
the main canopy. 


Prior to a water landing, the crewmember pulls 
the manual inflation tab for the life preserver 
unit. The unit is designed to inflate 
automatically upon immersion in any type of 
water, but should be activated manually as an 
additional safeguard. Upon landing in 
saltwater, the SEAWARS automatically releases 
the crewmember from the parachute risers. At 
the same time, the life raft automatically deploys 
and inflates. The crewmember's first task is to 
deploy the sea anchor and get into the life raft. 
Next, the crewmember pulls the activation tab on 
the upper СО» cylinder to inflate the upper 
chamber. Raft bailing proceeds by either using 
the spray shield, the bailing cup, or the bailing 


pump. 
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The crewmember's next task is to unpack 
the signaling equipment. The SARSAT 
personnel locator beacon is the primary 
signaling device. It is located on the raft 
spray shield. The telescoping antenna is 
extended, and the flexible antenna is 
removed. The PRC-112 is used to monitor 
282.8 MHz and establish voice contact with 
search and rescue forces. 


The arrival time of the search and rescue 
forces depends on where the bailout 
occurred. The first rescue force to arrive will 
probably be a C-130 transport aircraft, 
specially equipped for search and rescue. 
Two teams are dropped, each consisting of 
three rescue jumpers in a motorized rescue 
boat. One team drops to each end of the line 
of orbiter crewmembers. The C-130 may 
also drop two 20-person rafts for the 
assembled crewmembers and rescue 
personnel to wait in until rescue helicopters 
arrive. 
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Vehicle Loss of Control/Breakup 


Although there are no formal requirements for 
crewmembers to bail out of the orbiter during 
uncontrolled flight, they may be able to do so 
under certain circumstances. The pyro vent and 
hatch jettison pyrotechnics do not require orbiter 
power to function and can be activated even if 
orbiter power is lost. Each crewmember is 
wearing his or her own emergency oxygen 
bottles and parachute, and if the crew cabin is not 
tumbling rapidly, at least some crewmembers 
should be able to get to the side hatch and get out. 


In the case involving loss of orbiter control, the 
crewmembers should activate their emergency 
oxygen as soon as possible and then evaluate 
the situation. If the crew module is lofting to 
altitudes above 50,000 feet, the crew should 
remain within it until it passes through 40,000 
feet on the way back down. If the cabin is 
depressurized, the ACES and a cabin altimeter 
on the middeck can be used to judge the bailout 
altitude of 40,000 feet. 


The escape pole is intended for use only during 
controlled gliding flight, and its use should not 
be attempted during an uncontrolled bailout. 
Once out of the orbiter, crewmembers should 
pull their parachute ripcord handle to activate 
the automatic opening sequence for their 
parachutes. 
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Escape Systems Summary Data 


e Escape systems refer to equipment and 
systems intended to facilitate emergency 
egress of the flight crew. Escape systems 
include equipment worn by Ње 
crewmembers, hardware built into the 
orbiter, and external systems located on the 
launch pad. 


Escape by the flight crew on the launch pad 
is facilitated by descending to a safe area via 
slidewire baskets. The launch pad structure 
also includes an escape temperature and 
hydrogen fire-hazard monitoring system and 
a Firex spray system for water shower. 


The ACES is designed to protect 
crewmembers from (1) loss of cabin pressure 
and/or orbiter oxygen at altitudes of up to 
100,000 feet, (2) cold atmospheric and/or 
water temperatures after bailing out, (3) 
pooling of blood in the lower body, and (4) 
contaminated atmosphere during flight or 
post-landing procedures. 


The personal parachute assembly is worn by 
the crew in the event of bailout. It is 
designed to work automatically with the 
crew egress pole system or with manual 
backups as needed. 


The hardware associated with the orbiter for 
purposes of in-flight crew escape consists of 
several types of pyrotechnics plus the egress 
pole. 
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Three separate sets of pyrotechnics are 
associated with jettisoning the side hatch, all 
of which are activated simultaneously by 
squeezing and pulling a T-handle. 


The purpose of the egress pole is to guide 
escaping crewmembers on a trajectory that 
will clear the orbiter's left wing. 


The emergency egress slide is intended for 
use after a normal opening of the middeck 
side hatch or after jettisoning of the side 
hatch at the nominal end-of-mission landing 
site or at a remote or emergency landing site. 


In the event that egress through the side 
hatch is not possible, the port side flight deck 
overhead window (W8) provides the flight 
crew with a secondary emergency egress 
route. 


The commander may decide a bailout is 
necessary, if the range-to-go exceeds about 50 
n. mi. at an altitude of 55,000 feet. The orbiter 
is placed in a minimum-sink-rate attitude on 
autopilot. 


Bailout includes using the escape pole to 
leave the orbiter, deploying the parachute for 
descent, and inflating the life raft for a water 
recovery. Special survival gear and proce- 
dures are provided in the case of a bailout. 


211  EXTRAVEHICULAR ACTIVITY 


(EVA) 


CONTENTS 


EVA Overview 
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Simplified Aid for EVA Rescue. 
Operations 

EVA Summary Data 

EVA Rules of Thumb 


EVA Overview 


An EVA occurs when a crewmember leaves the 
protective environment of a spacecraft's pres- 
surized cabin and ventures out into the vacuum 
of space in a space suit. An EVA is commonly 
known as a spacewalk. Two EVAs are available 
for payload use, with a third reserved for 
orbiter contingency operations. EVA has been 
useful in satellite repair, retrieval, and refueling, 
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The current space suit, designed for a total 
maximum time of 7 hours, provides environ- 
mental protection, mobility, life support, and 
communications. Two suits are flown in each 
baseline orbiter mission, and consumables are 
provided for three two-person, 6-hour EVAs. 


An airlock is used when crewmembers go EVA. 
The airlock is depressed with the crewmembers 
within, allowing them to egress into vacuum. 
The airlock allows a small volume of the shuttle 
to be depressed, rather than the entire crew 
cabin. The external airlock provides docking 
capability with other space vehicles when 
outfitted with an orbiter docking system (ODS). 


There are three basic categories of EVA: 
scheduled, unscheduled, and contingency. A 
scheduled EVA is an EVA incorporated into the 
nominal flight plan to complete a specific 
mission objective. An unscheduled EVA is not 
part of the flight plan, but is conducted to 
achieve payload operation success or to 
advance overall mission accomplishments. A 
contingency EVA is also unscheduled, but is 
required to ensure safe return of the orbiter and 


as well as with space station assembly. crew. 
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STS-61B Nov 26-Dec 3, 85 Large Structure Assembly Spring/Ross 24 hr, 40 min 
STS-37 Apr 5-10, 91 GRO Satellite Repair/Locomotion Studies Ross/Apt 20 hr, 58 min 


Intelsat Repair and Assembly of Station by Thuot, Hieb, Akers, 59 hr, 51 min 
EVA Methods (ASEM) Hornton, 


8 hr, 56 min 


STS-51D Apr 12-19, 85 Syncome F3 Satellite Repair Griggs/Hoffman = 6 ћг, 20 тїп 
5Т5-511 Aug 27-Sep 3, 85 Syncome F3 Satellite Repair Fisher/Van Hoften 23 hr, 42 min 


STS-49 May 10-14, 92 


STS-54 


pense | Jan 17, 93 First EVA Detailed Test Objective (DTO Harbaugh, Runco 
1210) 


STS-57 


Jun 25, 93 EURECA Antenna Stow and Second EVA Low, Wisoff 1 
DTO (1210) 


STS-51 Sep 16, 93 Third EVA DTO (1210) 14 hr, 10 min 


STS-61 Dec 4-8, 93 Hubble Space Telescope Repair Mission Musgrave, Hoffman, 5 70 hr, 58 min 
Akers, Thornton 
STS-64 Sep 16, 94 SAFER First Flight 13 hr, 42 min 


STS-63 13 hr, 18 min 
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Space Shuttle EVA Chronology 
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Extravehicular Mobility Unit 


The extravehicular mobility unit (EMU) is an 
independent anthropomorphic system that pro- 
vides environmental protection, mobility, life 
support, and communications for the 
crewmember to perform EVA in Earth orbit. 
For EMU design considerations, an EVA is 
defined as any time the EMU external 
environmental pressure is below 4.0 psia. The 
EMU is designed to accommodate an EVA 
mission with a total maximum duration of 7 
hours, consisting of 15 minutes for egress, 6 
hours for useful EVA tasks, 15 minutes for 
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ingress, and a 30-minute reserve. The EMU also 
accommodates specific metabolic rate limits, 
including (1) an average metabolic rate not 
exceeding 1600 Btu/hr in any given EVA hour 
and not exceeding 1000 Btu/hr for the entire 
duration, (2) a peak metabolic rate not 
exceeding 2000 Btu/hr for a period of 15 
minutes, and (3) a minimum metabolic rate not 
less than 400 Btu/hr for a period of 30 minutes. 
The EMU is an integrated assembly, primarily 
composed of the space suit assembly, life 
support system, and numerous items of associ- 
ated support and ancillary equipment. 


2.11-2 


Space бий Assembly 


The space suit assembly (SSA) is the anthro- 
pomorphic pressure vessel that encloses the 
crewmember's torso, limbs, and head. The SSA 
provides a variety of functions while the 
crewmember performs an EVA, including suit 
pressure retention, crewmember mobility, crew- 
member liquid cooling distribution, oxygen 
ventilation gas circulation, downlink of crew- 
member's electrocardiogram data via EMU 
radio, crewmember interface with EMU radio, 
crewmember in-suit drinking water, and urine 
containment. The SSA operates under specific 
pressure requirements and leakage criteria. 


The space of the 


following: 


suit assembly consists 


• Hard upper torso/arms 

e Lower torso assembly 

e Extravehicular gloves 

® Helmet/extravehicular visor assembly 
e Liquid cooling and ventilation garment 
e Operational bioinstrumentation system 
® Communications carrier assembly 

e Disposable in-suit drink bag 


• Maximum absorption garment 


The hard upper torso (HUT) provides pressure 
containment for the upper torso as well as being 
the central component from which the mechani- 
cal, electrical, and fluid interfaces of the EMU 
branch. The HUT is available in four sizes to 
accommodate 5th through 95th percentile-sized 
crewmembers. The planar HUT, which deletes 
the arm gimbal and bellows assembly, will be 
available in two sizes. The HUT includes the 
following components: fiberglass shell (with 
water tubes and oxygen ducts), assorted 
mounting brackets, waterline and vent tube 
assembly, multiple water connector, EMU 
electrical harness, shoulder bearing assemblies, 
waist disconnect ring (passive half), helmet 
disconnect ring, and thermal micrometeoroid 
garment (TMG). The right and left arm assem- 
blies are flexible, anthropomorphic pressure 
vessels that encompass the arms. Each arm 
assembly includes the following components: 
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upper arm assembly, rotating scye bearing, 
lower arm assembly, rotating arm bearing, wrist 
disconnect ring, urethane pressure bladders, 
cloth restraint systems, and TMGs for the upper 
and lower arm assemblies. 


The lower torso assembly (LTA) consists of a 
flexible anthropomorphic pressure vessel that 
encompasses the waist, lower torso, legs, and 
feet. The LTA includes the following compo- 
nents: waist assembly, waist disconnect ring, 
trouser assembly, rotating waist bearing 
between the waist and trouser assemblies, boot 
assembly, urethane pressure bladders, cloth 
restraint systems, and TMGs for the waist, 
trouser, and boot assemblies. 


The current sizing of the arm/leg assemblies 
can be accomplished on the ground using 
different sizes of each assembly for a particular 
crewmember. There is also available an on- 
orbit capability of EMU resizing by using 
various arm/leg segments and sizing rings. 
The on-orbit quick-sizing capability, uses 
threaded quick-disconnects, softgood sizing 
elements, aluminum sizing rings, апа 
adjustable-length restraint lines. Тһе suit 
incorporates dual lip seal mobility bearings and 
low-torque fabric joints. 


2. SYSTEMS 
2.11 Extravehicular Activity (EVA) 


USA007587 
Rev. A 


The extravehicular gloves consist of a detach- 
able, flexible pressure vessel, encompassing 
each hand for use during EVA. The extrave- 
hicular gloves include the following compo- 
nents: urethane pressure bladder and cloth 
restraint system, wrist disconnect ring with 
rotating wrist bearing, two wrist gimbal rings, 
adjustable palm restraint bar/strap, wrist tether 
strap, fingertip heaters, and TMG with palm 
restraint bar. The current Phase VI series gloves 
are customized to fit individual crewmembers. 
The build process begins with a casting of the 
crewmember’s hands if a previously cast glove 
does not fit. 


Scye bearing 


4 Upper arm 


Lower arm 


Wrist disconnect 


Enhanced Arm Assembly 


The helmet, a "one-size-fits-all" model, consists 
of a detachable, transparent, hard pressure 
vessel encompassing the head. The helmet 
includes the following components: hard trans- 
parent bubble, helmet disconnect ring, helmet 
purge valve, and vent pad. Two crew optional 
items are also available for the helmet. One of 
these items is the Fresnel lens, which is 
mounted to the lower front inside of the helmet 
to improve display control module visibility for 
the crewmember. The other item is the valsalva 
device, attached to the inside of the bubble, 
which allows the crewmember to clear his or 
her ears during pressure changes. Тһе 
extravehicular visor assembly (EVVA) attaches 
to the helmet to provide the crewmember with 
visual, thermal, impact, and micrometeoroid 
protection. The EVVA includes the following 
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components: clear protective visor, sun visor, 
center and side eyeshades, fiberglass shell, and 
latch mechanisms and supporting structure for 
the visor and eyeshades. 


] Body seal closure 


SS Thigh sizing ring 
Я 1/2" 


Leg segment 


Boot sizing rings 

1/2" e N 

"E др === 
11/2" Се 


Enhanced Lower Torso Assembly 


The liquid cooling and ventilation garment 
(LCVG) is a form-fitting elastic garment worn 
against the crewmember's body. The LCVG 
includes the following components: outer 
restraint fabric, inner liner assembly, crew 
optional comfort pads, biomed pocket, dosime- 
ter pocket, water tubing network, paramanifold 
assembly, ventilation ducting network, vent 
plenum assembly, multiple water connector, 
and full torso zipper. The garment supports a 
network of tubing that circulates water over the 
body to provide cooling to the crewmember. It 
also supports a network of ducting that draws 
ventilation gas from the suit extremities and 
routes it back to the primary life support system 
to complete the suit ventilation loop. Connec- 
tions to the ducting in the HUT for both cooling 
water and ventilation flow are made at the 
LCVG half of the multiple water connector. 
Various sizing options for the LCVG are 
available to achieve a good fit for the 
crewmember. 
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Тһе communications carrier assembly (CCA) is 
a cloth aviator-type cap that positions and 
supports the electronics for interface with the 
EMU radio for crewmember communications. 
The CCA contains the microphones and ear- 
phones necessary for the EVA crewmembers to 
communicate with each other or with the 
orbiter. The CCA also allows the EVA crew- 
members to talk to Mission Control via the 
orbiter communications system. Six sizes allow 
the CCA to fit 5th through 95th percentile-sized 
crewmembers. The CCA includes the following 
components: skull cap, ear cups, ear phones, ear 
seals, microphone modules, microphone booms, 
summing module, interconnect wiring, interface 
cable, neck strap, crew-optional chin strap, and 
perspiration absorption strap. 


The disposable in-suit drink bag (DIDB) is a 
single use, heat sealed, flexible bladder 
assembly mounted within a reusable restraint 
bag. The DIDB holds 32 oz. of water. The 
restraint bag is mounted to the front interior of 
the HUT and has a drinking tube extending to 
the neck area. 


The maximum absorption garment (MAG) 
consists of multiple layers of material designed 
to rapidly absorb and store urine. The MAG is 
designed to be worn under the LCVG by male 
or female crewmembers during EVA. It has the 
capacity to hold 32 fluid ounces of urine and is 
disposable after use. The MAG includes 
multilayer absorbent material апа tape 
attachment straps. 


Life Support System 


The life support system (LSS) provides a safe 
living environment inside the EMU. The LSS 
provides a variety of functions while the crew- 
member performs an ЕМА. These include 
provisions for breathing oxygen, suit 
pressurization, crewmember cooling, crew- 
member communications, displays and controls 
for crewmember operation of the EMU, and 
monitoring of EMU consumables and opera- 
tional integrity. The life support system 
consists of the following: 


e Primary oxygen system 


e Secondary oxygen pack 
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• Oxygen ventilation circuit 

e Liquid transport cooling system 

• Feedwater circuit 

e Electrical interfaces 

e Extravehicular communicator (EMU radio) 
e Display and control module 

е Caution and warning system 


The primary life support subsystem (PLSS) 
consists of the primary oxygen system, oxygen 
ventilation circuit, liquid transport system, 
feedwater circuit, electrical interfaces, 
extravehicular communicator, and the caution 
and warning system. The secondary oxygen 
pack is a separate unit that is attached to the 
bottom of the PLSS. Together, the PLSS and the 
secondary oxygen pack make up the backpack 
of the EMU. 


The primary oxygen system provides a 
crewmember with breathing oxygen and 
satisfies pressure requirements for EVA. The 
system stores 1.217 pounds of oxygen at 850 
psia and 90° F. It delivers oxygen during EVA 
at 4.3 + 0.1 psid, and maintains a metabolic use 
rate range of 0.02 to 0.33 lb/hr. The system is 
charged through a servicing and cooling 
umbilical (SCU) to the orbiter environmental 
control and life support system. Charging 
pressure is 850 + 50 psig. The minimum usable 
pressure is 60 psi. The system performs various 
functions, including suit pressurization, 
provision of breathing oxygen, and water 
pressurization. The primary oxygen system 
includes the following components: oxygen 
tanks, oxygen tank pressure sensor, flow 
limiter, oxygen shutoff valve, oxygen actuator, 
suit pressure regulator, water pressure 
regulator, and dual mode relief valve. 


The secondary oxygen system, also known as 
the secondary oxygen pack (SOP), is the backup 
assembly to the primary oxygen system. This 
backup system provides a minimum of 30 
minutes of emergency oxygen with the DCM 
purge valve open. The SOP functions include 
suit pressurization, provision of breathing 
oxygen, and some degree of cooling in the 
purge mode. There is no required crewmember 
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interface to activate the SOP; it automatically 
activates whenever the oxygen actuator is in the 
EVA position and suit pressure is less than 3.9 
psid. The SOP includes two oxygen tanks, 
containing a total of 2.65 pounds of oxygen at 
5800 psia and 70° F. The system includes the 
following components: oxygen tanks, SOP inlet 
pressure gauge, first-stage regulator, interstage 
gauge, second-stage regulator/shutoff 
valve/flow restrictor, PLSS/SOP interface 
connector, and oxygen tank pressure sensor. 
The SOP is not rechargable on-orbit. 


The oxygen ventilation circuit forms a closed 
loop with the space suit assembly. The circuit 
provides oxygen for breathing, suit pressuriza- 
tion for intravehicular activity (IVA) and EVA 
operation, and ventilation for cooling and 
elimination of exhaled gases. The oxygen flow 
picks up heat, humidity, carbon dioxide, and 
other contaminants, which are removed from 
the EMU by the ventilation circuit components. 
The system includes the following components: 
fan/water separator, slurper/sublimator, vent 
flow sensor/backflow check valve, suit pressure 
sensor, suit pressure gauge, contaminant 
control (lithium hydroxide-LiOH) cartridge 
(CCC), carbon dioxide sensor, display control 


SOP 
regulator 
assembly — 


Actuation 


Shut-off 
feature 


(58: =] 


module purge valve, helmet purge valve, 
positive pressure relief valve, negative pressure 
relief valve, and SOP checkout fixture. 
Ventilation flow is picked up at the body 
extremities and returned to the upper torso via 
a vent duct manifold that is part of the LCVG. 
From the upper torso, the gas is routed back 
into the PLSS and the CCC. The LiOH CCC is 
sized to absorb 1.48 pounds of carbon dioxide 
associated with 7000 Btu of metabolic activity 
over a 7-hour EVA period. The cartridge is 
installed in the back of the PLSS and is 
replaceable on orbit. On the ground, the used 
LiOH cartridge can be recharged for future use. 


The liquid transport system uses the centrifugal 
pump to circulate approximately 240 lb/hr of 
water through the LCVG. The function served 
by the liquid transport system is to provide 
cooling to the crewmember. The system in- 
cludes the following components: pump, tem- 
perature control valve, LCVG, gas trap, pump 
priming valve, pump check valve, sublimator 
temperature sensor, and service and cooling 
umbilical bypass valve. During IVA operation, 
the pump circulates water not only through the 
EMU, but also through the service and cooling 
umbilical to the orbiter heat exchanger. 


— Frame and 
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LiOH Cartridge 


The feedwater circuit contains the equipment 
and water to dissipate heat loads imposed on 
the system by the crewmember, the PLSS, and 
the environment. It also contains equipment to 
remove moisture from the ventilation circuit 
and gas from the transport circuit, to separate 
the water and gas, and to put them back in their 
respective loops. The feedwater circuit func- 
tions involve heat rejection, LCVG water 
makeup, and vent loop condensate separation 
and storage. The system includes the following 
components: feedwater tanks (2 primary/1 
reserve), feedwater tank pressure sensors, 
reserve feedwater tank check valve, feedwater 
pressure regulator, feedwater shutoff valve, 
feedwater pressure sensor, sublimator, feed- 
water relief valve, condensate water relief valve, 
water separator, and coolant isolation valve. 
The primary and reserve tanks store approxi- 
mately 9 pounds of feedwater at 15 psig. The 
reserve feedwater tank provides 30 minutes of 
water for EMU cooling in the event that primary 
feedwater is depleted. Potable water from the 
orbiter ECLSS is used to fill or recharge the tanks. 


The EMU electrical system is composed of the 
following main components: battery, feedwater 
shutoff valve, coolant isolation valve, motor, 
instrumentation, extravehicular communicator, 
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display and control module, and caution and 
warning system. Electrical interfaces exist 
between the display and control module and 
parts of the PLSS, SOP, and C/W. The power 
supply for operation of all electrical components 
of the EMU is a battery installed in the back of 
the PLSS. The EMU battery consists of eleven 
sealed, silver-zinc, high current density cells 
connected in series. The battery provides a 
minimum of 32 amp-hr of power over a 7-hour 
EVA mission at a full charge voltage between 
21.6 and 21.9 V dc. 


The extravehicular communicator (EVC) is 
composed of two parts, the orbiter-based equip- 
ment and the EMU-based equipment. The 
orbiter equipment consists of the EVA/air 
traffic control transceivers and antennas. This 
configuration provides communication with the 
EVA crewmembers and relay between EVA 
crewmembers and the ground (including down- 
link ECG and real-time data system (RIDS) 
telemetry). The EMU equipment consists of the 
EMU radio and antenna. It provides voice 
communications with other EVA crewmembers 
and the orbiter, ECG/RTDS telemetry to the 
orbiter for recording and/or downlink, and 
caution and warning tones to alert the EVA 
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crewmember of anomalies or other significant 
events. The EVC includes the following compo- 
nents: orbiter UHF system, EMU radio, EMU 
electrical harness, communications carrier 
assembly, biomed sensors; COMM MODE 
selector switch, FREQ switch, volume controls, 
and real-time data system. Orbiter panels O6, 
AIR, and R10 are the crew communication 
interfaces. The panels control UHF operation, 
air-to-air or ground transmission, and biomed 
data downlink/recording respectively. 


The display and control module (DCM) 
contains all controls and displays necessary for 
nominal operation and monitoring of EMU 
systems. The DCM includes the following 
components: POWER mode switch, DISPL 
switch, FAN switch, WATER switch, FREQ 
switch, communications volume controls, 
display intensity control, oxygen actuator, 
temperature control valve, pressure gauge, 
DCM purge valve, alphanumeric display, and 
COMM mode selector. The DCM is installed on 
the hard upper torso, with the surfaces covered 
with a TMG. This TMG contains the labels for 
the controls and displays. 


Feedwater switch 
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The EMU caution and warning system (CWS) 
consists of instrumentation and a microprocessor 
to obtain, process, and visually display 
information for use by the EVA crewmember in 
the operation and management of the EMU. The 
system contains built-in test equipment (BITE), 
consisting of software and hardware that verify 
proper CWS operation. CWS serial data are also 
routed to the ground by the real-time data 
system. The CWS functions involve displaying 
EMU leak check procedures, monitoring and 
displaying EMU consumables status, monitoring 


EMU operational integrity, and alerting 
crewmembers to EMU anomalies. The system 
includes the following components: 


alphanumeric display with BITE indicator, dis- 
play (DISPL) switch, alert/status/ warning tones, 
sensors, and "black Бох" processor. The CWS 
receives inputs from EMU sensors and from the 
DISPL switch located on the DCM. Sensors 
gather information throughout the EMU system 
and relay it to the CWS. Information is provided 
on pressures, temperatures, currents, and 
voltages. 


Communications mode selector switch 
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Display and Control Module 
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EMU Ancillary Equipment 


The EMU ancillary equipment consists of 
hardware necessary to support the EMU during 
all phases of EVA (prep/post/operation). The 
following list itemizes the components with a 
brief description of their functions. 


EMU helmet lights - Attach to the helmet EVVA 
and provide two functionally independent sets of 
lights for portable lighting during an EVA task. 


EMU scissors - Steel cutters with one serrated 
edge capable of cutting anything from fabric 
bags and straps to lightweight steel cable and 
Kevlar cord. 


EMU wrist mirror - Attaches to the wrist of the 
EVA glove to allow the EVA crewmember to 
view the controls and displays on the DCM or 
other areas of the EMU. 


EVA cuff checklist - A set of reference cards 
bound by an aluminum alloy bracket attached 
to a wrist band. The reference cards, approxi- 
mately 4 inches by 5 inches in size, contain 
procedures and reference data for performing 
EVA tasks and for aiding in the diagnosis and 
resolution of EMU malfunctions. 


In-suit drink bag syringe - A device used to 
remove gas from the water in the drink bag. 
The needle of the syringe is inserted in the inlet 
valve of the bag, and gas is suctioned out of the 
bag with the syringe. 


Thermal mittens - An adjustable enclosure 
composed of several layers of thermal blankets 
and aluminized Mylar with a layer of Nomex 
felt on the palm and undersides of the fingers 
that fit conformally around the EV gloves to 
provide greater thermal hand protection at 
extreme high and low temperature worksites. 


Lower torso assembly donning handles - Left and 
right handles that aid in the mating of the hard 
upper torso and lower torso assembly halves of 
the waist ring. 


Body Seal Closure Contingency tool (LTA prybar) - 
A pry bar used to disconnect the LTA and HUT 
halves of the waist ring in the event that the 
latching mechanism becomes jammed. 
Operation of the pry bar may damage the 
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latching mechanism; therefore, it should be 
used only if the waist ring becomes jammed and 
the crewmember is entrapped in the space suit. 


Bends treatment adapter (BTA) - An emergency 
device that may be used on-orbit in the event an 
EVA crewmember contracts decompression 
sickness (bends). The BTA converts the EMU 
into a hyperbaric treatment chamber, pressuriz- 
ing the EMU to 8.0 psid over ambient cabin 
pressure. 


SOP checkout fixture - A flight support test item 
installed on the HUT half of the neck ring 
during pre-EVA operations. 


DCM plug - A cover that attaches to the multiple 
connector on the DCM in the event that water 
begins leaking from the connector after the 


service and cooling umbilical multiple 
connector is removed. 
EMU servicing kit - Items necessary for 


preparing the EMU for EVA, such as antifog 
wipes, tissue-type wipes, and scissors. It also 
contains additional equipment necessary for 
routine EMU maintenance, including valsalva 
devices, stericide wipes, and lubricant wipes. 


Bio kit - Equipment associated with the biomed 
instrumentation, including EVA cables, over- 
tapes, electrode placement illustration, alcohol 
wipes, stoma seals, and electrode paste. 


Airlock stowage bag - A Nomex bag used for 
temporary storage and transfer of items used in 
prep- and post-EVA operations. When stowed 
in the airlock over the inner hatch, the bag and 
its contents are removed from the airlock prior 
to airlock depressurization. 


EVA bag - Used to stow various items (camera, 
thermal mittens, tool caddy) in the airlock for 
possible use during EVA. The EVA bag 
remains in the airlock during the EVA. 


External Airlock 


The external airlock on the  orbiter 
accommodates astronaut EVA operations. The 
external airlock permits EVA crewmembers to 
transfer from the middeck crew compartment 
into the payload bay in EMUS through a short 
tunnel, without depressurizing the orbiter crew 
cabin. The external airlock can stow two EMUs 
and has the interfaces and associated displays 
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and controls for the orbiter systems that support 
EMU operation and servicing. Sized to 
accommodate a two-person EVA, the external 
airlock dimensions have a diameter of 63 
inches, a length slightly longer than 83 inches, 
and three D-shaped 40-inch-diameter openings. 
The floor is not solid; it is a cover over the 
endcone at the bottom of the external airlock. It 
has an empty volume of 228 cubic feet. The 
external airlock depresses a total volume of 208 
cubic feet with two EMUs. Support functions 
performed in the external airlock include 
depressurization and repressurization, EVA 
equipment recharge, LCVG water cooling, and 
EVA equipment checkout, donning, and 
communications. АП EVA gear, checkout 
panel, and recharge stations are located against 
the internal walls. 


External Airlock Hatches 


Three pressure-sealing hatches are mounted on 
the airlock. They are designated as an inner 
hatch, an EV hatch, and a docking hatch. 


The inner hatch is located on the exterior of the 
external airlock opening into the middeck. The 
inner hatch isolates the airlock from the crew 
cabin. The inner hatch is hinged to be pulled 
first into the middeck and rotated down until it 
rests with the low-pressure (outer) side facing 
the airlock floor. The hatch has a hold-open 
hook that snaps into place over a flange when 
the hatch is fully open. 


The EV hatch isolates the airlock from the 
unpressurized payload bay when closed and 
permits the EVA crewmembers to exit from the 
airlock to the payload bay when open. The EV 
hatch of the external airlock opens in the same 
manner as the inner hatch. 


The external airlock's third hatch is an additional 
upper, outer hatch that is used for docking 
operations. The docking hatch, located on the 
top of the external airlock (toward the payload 
bay doors), is hinged to be pulled into the 
external airlock and then rotated until the low 
pressure side rests against the airlock wall 
facing toward the nose of the orbiter. 
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Each hatch has interconnected latches with 
gearbox and actuator a window, a hinge 
mechanism with hold-open device, a differential 
pressure gauge on each side, and two 
equalization valves. The external airlock hatches 
also have hold-open protection and deployable 
struts for support against the airlock structure. 


External airlock repressurization is controlled 
from the middeck or inside the external airlock. 
It is performed by equalizing the external; 
airlock and cabin pressure with airlock-hatch- 
mounted equalization valves on the inner hatch. 
Depressurization of the external airlock is 
controlled from inside the external airlock. It is 
depressurized by venting the external airlock 
pressure overboard. The three D-shaped airlock 
hatches are installed to open toward the pri- 
mary pressure source, the orbiter crew cabin, to 
achieve pressure-assist sealing when closed. 
Each hatch opening is 40 inches in diameter, yet 
with one side being flat, the minimum dimen- 
sion is 36 inches. 


The 4-inch-diameter window in each external 
airlock hatch is used for crew observation from 
the cabin to the airlock and the airlock to the 
payload bay. The dual window panes are made 
of polycarbonate plastic and are mounted di- 
rectly to the hatch using bolts fastened through 
the panes. Each external airlock hatch has dual 
pressure seals to maintain the external airlock's 
pressure integrity. One seal is mounted on the 
external airlock hatch and the other on the 
external airlock structure. A leak check quick 
disconnect is installed between the hatch and 
the airlock pressure seals to verify hatch 
pressure integrity before flight. 


Each airlock hatch has the following design 
characteristics: (1) capable of being fully locked/ 
unlocked from either side, (2) designed for 2000 
open/close cycles, (3) one-handed operation by 
astronaut in pressure suit, (4) capable of opening 
against 0.2 psid maximum, (5) latches capable of 
withstanding 20 g's in the +Х direction, and (6) 
actuator handle load of 30 pounds maximum. 


The gearbox with latch mechanisms on each 
hatch allows the flight crew to open or close the 
hatch during transfers and EVA operations. 
The gearbox and the latches are mounted on the 
low-pressure side of each hatch, with a gearbox 
handle installed on both sides to permit 
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operation from either side of the hatch. Some of 
the latches on each hatch are double-acting with 
cam surfaces that force the sealing surfaces 
apart when the latches are opened, thereby 
acting as crew-assist devices. To latch or 
unlatch the hatch, the gearbox handle must be 
rotated 440°. 


The hatch actuator/ gearbox is used to provide 
the mechanical advantage to open and close the 
latches. The hatch actuator lock lever requires a 


force of 8 to 10 pounds through an angle of 180° 
to unlatch the actuator. A minimum rotation of 
440° with a maximum force of 30 pounds 
applied to the actuator handle is required to 
operate the latches to their fully unlatched 
positions. 


The hinge mechanism for each hatch permits a 
minimum opening sweep into the airlock or the 
crew cabin middeck. 


External Airlock 
(port side view) 
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Airlock Repressurization, Schematic Diagram 
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Forward fuselage Airlock in middeck 


Airlock/Tunnel Adapter 


2.11-13 2. SYSTEMS 
2.11 Extravehicular Activity (EVA) 


USA007587 
Rev. A 


External Airlock Subsystems 


The external airlock air circulation system 
provides conditioned air to the external airlock 
during non-EVA periods. Upon external airlock 
hatch opening in flight, a duct is installed on the 
middeck floor fitting by the flight crew through 
the cabin/airlock hatch and connected to the 
airlock booster fan. The duct has threaded 
fittings installed on the end of it which are used 
to secure it The duct must be removed from the 
airlock before the cabin/ airlock hatch is closed 
for chamber depressurization. 


To assist the crewmember before and after EVA 
operations, the external airlock incorporates 
handrails and foot restraints. Handrails are 
located alongside the avionics and ECLSS 
panels, with aluminum alloy handholds 
mounted on each side of the hatches. Each 
handrail has a clearance of 2.25 inches between 
the airlock wall and the handrail to allow 
crewmembers to grip it while wearing a 
pressurized glove. 


External airlock-based EMU support 
components provide for EMU stowage, EMU 
operational support, and EMU recharge during 
intravehicular activity operations. These 
components include the EMU mount, the 
service and cooling umbilical, and the lower 
torso restraint bag. The EMU mount provides a 
mechanical interface between the EMU and 
airlock wall for EMU stowage. The mount 
attaches to the back side of the EMU and 
engages with three fixtures on the wall of the 
external airlock. The mount is also used to 
maintain the EMU in a fixed position on orbit 
for EMU donning and doffing operations. Ё 
necessary, the EMU mount can be removed 
from the airlock wall while on orbit. 


The service and cooling umbilical consists of 
three water hoses, a high pressure oxygen hose, 
electrical wiring, water pressure regulators, and 
a strain relief tether. The system is used to 
interconnect the EMU and the orbiter airlock for 
the following major functions: electrical power, 
hardline communications, oxygen supply, 
wastewater drainage, water cooling capability 
and recharge capability for the PLSS oxygen 
tanks, water reservoir, and battery. 
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The lower torso restraint bag is attached to the 
bottom of the EMU mount and covers the lower 
torso of the EMU to restrain it during launch 
and entry. Straps on either side of the bag are 
attached to points on the upper part of the EMU 
mount and are tightened to ensure that the 
EMU is fully restrained. 


The external airlock is used in conjunction with 
a tunnel adapter during Spacehab missions 
when the orbiter is docked to the 155. Тһе 
airlock tunnel adapter, hatches, tunnel 
extension, and tunnel permit the flightcrew to 
transfer from the orbiter's pressurized middeck 
compartment to the Spacehab pressurized shirt- 
sleeve environment. An upper hatch in the 
tunnel adapter provides egress/ingress for EVA 
operations. In the event of an EVA, the 
flightcrew may not be present in the Spacehab. 


EVA Support Equipment 


A variety of equipment is available to support 
the EVA crewmember. Depending on the task 
to be performed, the proper tool is available 
outside the airlock. The general equipment 
functions include securing the crewmember to 
the orbiter/RMS, providing the crewmember 
with mechanical assistance, and assisting the 
crewmember in mobility. The following list 
itemizes the EVA support components with a 
brief description of their functions. 


Crewmember safety tether - Ensures the 
crewmember is positively tethered to the orbiter 
while providing access to all areas of the 
payload bay. Before airlock egress, this safety 
tether is attached to a waist tether and remains 
attached at all times during EVA, while the 
crewmember translates from one area of the 
payload bay to another. 


Slidewires - Facilitate the translation of a 
crewmember and equipment in the forward and 
aft directions of the payload bay. Two slide- 
wires, one on each side of the payload bay, may 
be installed for a length of approximately 46 
feet. 


Tethers - Include waist and wrist tethers. Waist 
tethers are used to attach the crewmember to 
the orbiter safety tether system and to provide 
additional crewmember restraint at a worksite 
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when required. Waist tethers use a large hook 
to be attached to various tether points 
(including the crewmember safety tether) and a 
small hook that attaches to an EMU waist tether 
ring. Wrist tethers are used to secure tools and 
hardware to the EVA crewmember and to tether 
points. Wrist tethers are both fixed and 
adjustable, attaching to loops on the EMU 
glove. 


Handrails - Aluminum tubing strategically 
located to aid in crewmember translation or 
restraint to accomplish a specific task. Hand- 
rails are located on the forward and aft bulk- 
heads, the hingeline of the payload bay doors, 
and the RMS end effector. Handrails are 
designed with tether attach points. 


Portable foot restraint - A working platform 
designed to restrain the EVA crewmember 
while performing contingency operations on 
various components of the payload bay 
systems. The portable foot restraint stabilizes 
the crewmember by using a system of toe 
guides and heel clips designed to interface with 
the EMU boots. 


EVA Winch - Allows the EVA crewmember to 
close the payload bay doors in the event of a 
payload bay door drive system failure. Prior to 
launch, the winch is mounted on both the 
forward and aft payload bay bulkheads. The 
winch consists of a reel, assisted by spring 
energy, housing 24 feet of 3/8-inch-diameter 
Kevlar rope with a hook attached to the 
free end. 


Mini-workstation - A mechanical device that 
mounts on the front of the EMU to stow tools 
and to provide a means of tether restraint for an 
EVA crewmember at a worksite. 


Tube cutter - Used for a contingency door- 
closing operation. The tool consists of spring- 
loaded retention rollers, a cutter wheel mounted 
on a slide, a blade ratchet handle, a rotating 
body, a control lever, and a tube-cutter ratchet 
handle. It is designed to cut drive door 
linkages. 


General purpose cutter (large cutter) - Designed to 
cut larger cables, wires, and structural tubes 
that cannot be cut by the compound cutter. The 
ratchet direction of the jaws is controlled by an 
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open-and-close lever mounted on the head of 
the tool. 


Payload bay doors disconnect tools - Used to 
disengage the power drive unit on each payload 
bay door from the power-drive-unit torque 
shaft, allowing manual closing of the doors. 
The tool is approximately 6-3/4 inches long 
from the tip of the tether ring to the end of the 


3/8-inch steel, square drive extension. 
Additional tools for disconnecting the door 
drive linkage system include  vise-grip, 


ratcheting box-end wrench, adjustable wrench, 
loop pin extractor, Velcro/ tape caddy, bolt 
puller, and trash bag. 


Three-point latch tool - Used to compensate for failed 
bulkhead latches. The tool consists of a stowable 
ratchet handle, two interchangeable tool handles, a 
ratchet control selection lever, a spring-loaded 
compensator, and two fixed-load pickup points. 


Centerline latch tool - Used to compensate for a 
failed payload bay door centerline latch. The tool 
consists of а fixed-load and a spring-loaded 
pickup point, plus a reversible ratchet with a 
stowable handle and a pair of trigger release 
buttons with a safety that prevents an accidental 
release. 


Airlock latch disconnect tool - A common, EVA- 
modified, crescent wrench used to force open a 
jammed latch and/or latches disconnected from 
the rotary actuator. The other contingency air- 
lock disconnect tool is a drive ratchet with a 
7/ 16-inch hex socket and 4-inch extension. 


RMS rope reel - Used with the snatch blocks in 
case of an RMS joint failure. The reel consists of 
a rope spool, spool bracket, rope guide, and 
cam cleats. The горе reel contains 
approximately 80 feet of 5/16-inch-diameter 
Kexlon rope. 


Snatch block - A common marine device used, in 
the event of an RMS failure, in conjunction with 
the RMS rope reel and EVA winch to backdrive 
the RMS toa stowed position. 


Payload retention device (PRD) - Used as an on- 
orbit temporary tiedown tool so that the article 
or payload being secured can be repositioned as 
necessary to prevent damage. It consists of a 
housing that encloses a 15-foot Kevlar webbing 
strap on a spring-loaded reel. 
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RMS manipulator positioning mechanism wrench 
(RMS MPM wrench) - A double-ended, open- 
end steel wrench used to deploy or stow the 
MPMs (in the event the MPM motors fail) by 
manually turning the drive shaft in the 
appropriate direction, thus allowing for 
payload deployment and/or payload bay door 
closing. 


RMS shoulder brace release - A flat steel bar with 
an angled foot used to disengage the RMS 
shoulder brace locking mechanism, thus releas- 
ing the shoulder brace. If the lock is not 
released, the RMS is inoperative. 


Grapple fixture release tools - Used to remove a 
grapple fixture shaft should an end effector mal- 
function, failing to release a payload. The tools 
include a probe and 1/2-inch ratcheting box-end 
wrench. 


Radiator actuator disconnect tools - A 3/8-inch 
drive ratchet and 1/4-inch allen wrench exten- 
sion used to disconnect the radiator actuators 
and support stowage of the radiators in the 
event of a failure. 


External tank umbilical door tool - Used to 
override a failed external tank door centerline 
latch and support ET door closure. 


Generic jam removal tools - Compound cutters, 
needle nose pliers, probe, hammer, prybar, 
forceps, trash bag. For use in disconnecting or 
dislodging jams in various orbiter mechanisms, 
such as PLBD hinges, latches, etc. 


Portable foot restraint (PFR) bridge clamp - Provides 
a PFR socket that mounts on the sill of the PLB in 
available locations on existing bridge rails. 
Simplified Aid for EVA Rescue 


The simplified aid for EVA rescue (SAFER) is a 
small, self-contained, propulsive backpack 
system used to provide a free-flying rescue 
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capability for an EVA crewmember. SAFER is a 
"simplified," single-string system that fits on the 
bottom of the EMU PLSS and attaches to existing 
mounts on the sides of the PLSS. 


SAFER is designed to be used as a self-rescue 
device for a separated EVA crewmember in 
situations where the orbiter is unavailable to 
provide rescue capability. Such situations would 
include when the orbiter is docked to a large 
payload or structure, such as the ISS. The SAFER 
will also be used during all future ISS EVA 
operations where the orbiter might not be present 
at the ISS during an EVA. 


To provide self-rescue capability, the SAFER 
offers a minimum of 13 minutes of battery 
power. The SAFER has 24 gaseous-nitrogen 
(СМ) thrusters to provide 6 degrees-of-freedom 
maneuvering control. The SAFER is controlled 
by a single hand controller housed in a hand 
controller module box located on the bottom of 
the unit. The SAFER propulsion subsystem 
provides a total delta velocity of at least 8 ft/sec 
with an initial charge. The flight unit weighs 
approximately 85 pounds and folds for launch, 
landing, and on-orbit stowage. 


The SAFER is the product of a Johnson Space 
Center (JSC) in-house project to develop, build, 
and produce a rescue device for when the orbiter 
cannot provide rescue capability and for ISS EVA 
operations. An on-orbit SAFER detailed test 
objective (DTO) conducted on shuttle mission 
STS-64 was very successful. This DTO demon- 
strated SAFER's operational capabilities and 
collected performance data to augment the 
design and development of the final operational 
SAFER. The STS-76 SAFER was a transitional 
unit between the DTO unit flown on STS-64 and 
the final production unit that was manifested for 
ISS. SAFER has a limited certification timeframe; 
however, after use on orbit, the unit will be 
returned to Earth for refurbishing. 
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Attachment of SAFER to EMU 


Operations 


As previously discussed, there are three types 
of EVA: scheduled, unscheduled, and 
contingency. A scheduled EVA is defined as 
any EVA incorporated into the normal flight 
plan in order to complete a specific mission 
objective. A subcategory of scheduled EVA is 
the quick-response EVA, which must be 
performed within a few hours after a problem is 
discovered. It is usually associated with 
payload deployment. Quick-response EVAs are 
planned pre-flight, and the crew prepares for 
the EVA even though it may not be performed. 


An unscheduled EVA is not part of the flight 
plan; rather, it is conducted to achieve payload 
operation success or to advance overall mission 
accomplishments. 


A contingency EVA is also unscheduled, but is 
required to ensure safe return of the orbiter and 
flight crew. Contingency EVAs occur if orbiter 
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hardware sustains a malfunction. Procedures, 
tools, апа specified work locations аге 
identified for practice on any STS mission. The 
recognized failures pertain to the following 
orbiter systems: radiator actuator, payload bay 
doors, bulkhead latches, centerline latches, 
airlock hatch, remote manipulator system 
(RMS), bulkhead camera, Ku-band antenna, and 
external tank doors. The corrective actions for 
each system failure are itemized in the System 
Failure Corrective Actions Table. 


Extravehicular activities are classified according 
to level of complexity: simple, intermediate, or 
complex. A simple payload EVA requires mini- 
mal unique tools, mockups, or mobility aids. 
Existing procedures and techniques may be 
adapted to particular EVA needs, thus requiring 
minimal crew training. An intermediate pay- 
load EVA requires development of new tools 
and equipment. Some procedure and technique 
development is required, with more extensive 
training necessary. A complex payload EVA 
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requires the design and development of com- 
plex or elaborate tools and equipment. The 
tasks require extension of basic capabilities and 
may pose difficulty in access or restraint. 
Procedure апа technique development 15 
extensive, as are crew training requirements. 


Regardless of the EVA type, a series of proce- 
dures is required to initiate and terminate an 
EVA. These procedures cover an integrated 
timeline sequence from the EVA checklist. The 
detailed procedures are summarized for refer- 
ence in the following steps: 


1. Quick don mask prebreathe - Donning 
of the mask for prebreathe and cabin 
depressurization. 


2. Cabin depressurization to 10.2 psi - 
Reducing the cabin pressure from 14.7 
psi to 10.2 psi. 


3. ЕМИ checkout - Preliminary checkout 
of the EMU systems prior to EMU 
donning. 


4. Міййеск preparation and preparation 
for donning - Configuration of the 
EMU and its ancillary components for 
crewmember donning. 


5. Suit donning - Crewmember donning 
of the EMU and ancillary components, 
approximately 40 minutes duration. 


6. EMU check - Configuration and 
checkout of the EMU prior to EMU 


purge. 
7. ЕМИ purge - Nitrogen purge of the 
EMU prior to prebreathe. 


8. Prebreathe - Crewmember acclimation 
to lower chamber pressure, over a 
period of 40 to 70 minutes. 


9. Preparation for depressurization - 
Configuration of the airlock and 
closing the inner hatch prior to airlock 
depressurization. 


10. Airlock depressurization - Configura- 
tion and checkout of the EMU, airlock 
depressurization to vacuum, and 
opening of the outer hatch. 
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11. Airlock repressurization - Airlock 
repressurization and opening of the 
inner hatch. 


12. Post-EVA - Shutdown of the EMU 
systems and doffing of the EMU and 
ancillary components. 


13. ЕМИ maintenance/recharge - Change- 
out or recharge of the EMU battery 
and lithium hydroxide cartridge and 
general cleaning of the EMU Юг 
subsequent EVA; recharge of the EMU 
water system. 


14. Post-EVA entry preparation - Recon- 
figuration and restowage of the EMU 
and airlock equipment. 


A set of procedures are followed when a 
crewmember has contracted the bends during 
an EVA. The crewmember discontinues the 
EVA and returns to the airlock to connect to the 
service and cooling umbilical. The airlock is 
repressed to 10.2 psia, and the cabin is 
repressed to 14.7 psia. The helmet is doffed, 
and the crewmember drinks a minimum of 32 
ounces of fluids. After proper ЕМІ) 
reconfiguration, the bends treatment adapter is 
installed for bends recovery. 


Scheduling ап EVA is a very complex and 
involved task. The following list outlines the 
general mission constraints regarding EVA, but 
does not attempt to define the detailed specific 
activities. 


e The maximum scheduled duration for 
an EVA is 6 hours. 


e All scheduled and unscheduled EVAs 
require two crewmembers. 


® No scheduled or unscheduled EVA shall 
occur on flight day 1 (724 hours МЕТ). 


е No scheduled EVA shall be planned to 
occur prior to flight day 4 (-72 hours 
MET) unless: 


i) А specific flight is dedicated to 
scheduled EVA activity, and 
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ii) That payload customer has 
specifically negotiated with NASA 
for the early scheduled EVA 
capability, and an exemption is 
processed. 


e The latest an EVA may be scheduled in 


preflight planning is EOM-2. 


е No unscheduled EVA shall be planned 


to occur prior to flight day 3 (~48 hours 
MET) unless: 


i A specific payload has no alterna- 
tive but to utilize an EVA as its 
third level of redundancy for the 
purpose of a critical backup to 
deploy/operations that would 
prevent loss of the payload, and 


ii) That payload customer has been 
made aware of the inherent risk 
that the EVA may not be able to 
be performed due to crew status, 
and the customer has agreed to 
accept the risk, and 


iii) That payload customer has spe- 
cifically negotiated with NASA 
for the early unscheduled EVA 
capability, and an exemption is 
processed. 


* Thefollowing are required response times 


prior to an unscheduled payload EVA: 
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i) Upon the discovery of a failure 
leading to an EVA, approximately 
24 hours are allotted for EVA 
preparation prior to starting 
actual EVA maintenance on a 
failed component. 


ii) If the case above occurs on launch 
day, then approximately 44 hours 
are allotted prior to starting EVA 
maintenance. 


iii) If a payload requires a shorter 
EVA response time, the 
requirement for that EVA must be 
negotiated with NASA, and an 
exemption must be processed. 


• Payload activities that could require an 


unscheduled EVA at the end of a 
mission may only be scheduled if there 
are sufficient consumables and landing 
opportunities to extend the mission to 
perform the EVA and preserve 2 wave- 
off days. 


A minimum of 1 flight day must sepa- 
rate two scheduled EVAs, for any given 
EVA crewmember. 


A contingency EVA will be scheduled in 
real time whenever it is necessary to 
restore the orbiter to a configuration for 
safe return. 
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FAILURE CORRECTIVE ACTION 
Radiator actuator Radiator actuator disconnect 


Payload bay door system 
Winch operations 
PLBD drive system linkage cut 
PLBD drive system disconnect 
Electrical crossover disconnect 


Jam removal 


Bulkhead latch 3-point latch tool installation 
Jam removal 

Centerline latch Centerline latch tool installation 
Jam removal 


Airlock hatch Airlock latch disconnect 
Hinge disconnect 

RMS RMS joint alignment 
RMS tiedown 


MPM stow/ deploy 
RMS shoulder brace release 


Grapple fixture release 


Bulkhead camera Disconnect and remove camera 


Ku-band antenna fails to align for | Ku-band antenna gimbal alignment 
stowing 


External tank door ET door centerline latch release 


System Failure Corrective Actions Table 
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EVA Summary Data 


EVA refers to operations performed outside 
the spacecraft crew compartment. 


For generic orbiter missions, two suits are 
included with consumables provided for 
three, two-person, 6-hour EVAs. 


There are three basic categories of EVA: 
scheduled, unscheduled, and contingency. 


The extravehicular mobility unit (EMU) is an 
independent anthropomorphic system that 
provides environmental protection, mobility, 
life support, and communications for the 
crewmember to perform EVA in Earth orbit. 
An EVA is defined, for EMU design consid- 
erations, as any time the EMU external 
environmental pressure is below 4.0. 


The EMU is an integrated assembly, primar- 
ily composed of the space suit assembly, life 
support system, and numerous items of 
associated support and ancillary equipment. 


EVA Rules of Thumb 


Always use "make before break" tether proto- 
col. 


Do not use the glove as a hammer. 


EVA crewmember and equipment must 
remain tethered at all times. 


Slow, deliberate motion provides much 
greater stability than quick, jerky motions. 


Body positioning is 90 percent of the task. 


Each EVA crewmember should check out his 
or her own EMU. 
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The orbiter's external airlock permits EVA 
flight crew members to transfer from the 
middeck crew compartment into the payload 
bay in EMUs without depressurizing the 
orbiter crew cabin. The external airlock also 
provides launch and entry stowage of up to 
two EMUs. 


The external airlock's support functions 
include airlock depressurization апа 
repressurization, EVA equipment recharge, 
LCVG water cooling, EVA equipment 
checkout, donning, and communications. 


Depending on the task to be performed, the 
proper tool is available outside the external 
airlock. The general EVA-support 
equipment functions include securing the 
crewmember to the orbiter/ RMS, providing 
the crewmember with mechanical assistance, 
and assisting the crewmember in mobility. 


A standard series of procedures (pre and 
post operations) are required to initiate and 
terminate an EVA, regardless of the EVA 


type. 
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212  GALLEY/FOOD 


CONTENTS 


Description 


The middeck of the orbiter is equipped with 
facilities for food stowage, preparation, and 
dining. The food supply is categorized as either 
menu food, pantry food, or fresh food. Meals 
are individually tailored, based on crewmember 
preference. Menu food consists of three daily 
meals per crewmember and provides an aver- 
age energy intake of approximately 2,700 
calories per crewmember per day. The pantry 
food is a 2-day contingency food supply that 
also contains food for snacks and beverages 
between meals and for individual menu 
changes. Pantry food provides an average 
energy intake of 2,100 calories per crewmember 
per day. Fresh food items consist of perishable 
items such as fruits, vegetables апа tortillas. 
The types of food include fresh, 
thermostabilized, rehydratable, irradiated, 
intermediate-moisture, and natural-form and 
rehydratable beverages. 


Three 1-hour meal periods are scheduled for 
each day of the mission. Breakfast, lunch, and 
dinner are scheduled as close to normal meal 
times as possible. Dinner is scheduled at least 2 
to 3 hours before crewmembers begin their pre- 
sleep activities. 


Galley 


The galley is a multipurpose facility that 
provides a centralized location. for one 
individual to handle all food preparation 
activities for a meal. The galley has facilities for 
heating food, rehydrating food, and stowing 
food system accessories. The galley consists of 
a rehydration station, oven, hot water tank, and 
associated controls. 
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Oven 


The oven is divided into two principal compart- 
ments: an upper compartment designed for 
heating up to 14 rehydratable food containers 
inserted on tracks, and a lower compartment 
designed to accept up to 7 flexible packages. 
The OVEN/RHS ON/OFF switch provides 
power to the oven heaters and the control 
electronics assembly. The oven fan ON/OFF 
switch enables/disables power to three oven 
fans. These fans circulate warm air over a heat 
sink, thus providing forced convection heating 
for the rehydratable packages. The flexible 
packages are held against the heat sink by three 
spring-loaded plates, and warmed Бу 
conduction. The oven has a heating range of 
160° to 185° F. The oven door is operated by a 
"squeeze" latch requiring only 3 Ib of pressure 
to open. 


Rehydration Station Dispensing System 


The galley rehydration station dispensing 
system interfaces directly with food and bever- 
age packages to provide rehydration capability 
and drinking water for crewmembers. 


When both WATER HEATER switches are 
turned on, 145? - 165? F water is available for 
rehydration. The VOLUME/OUNCES switch 
selects the volume of water to be dispensed by 
the rehydration station in 0.5-ounce increments 
from 0.5 of an ounce to 8 ounces. The yellow 
(HOT) pushbutton indicator allows hot water to 
be dispensed when it is depressed and is 
illuminated when energized. When the selected 
volume of water has been dispensed, the 
pushbutton will begin to flash on and off. The 
light will be extinguished when the food 
package is retracted, releasing the rehydration 
station lever ARM/LIMIT switch. 


The blue (COLD) pushbutton indicator allows 
cold water (40° - 60° F) to be dispensed when it 
is depressed апа 15 illuminated when 
energized. 


The rehydration station lever ARM/LIMIT 
switch serves as an interlock so water can be 
dispensed only when а food package 15 
connected to the needle. The food package 
makes contact with the rehydration station lever, 
which activates the LIMIT switch (note that the 
flight crew does not physically actuate the lever). 
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Galley Controls 


The galley controls consist of the OVEN/RHS 
switch, the two WATER HEATER switches, the 
OVEN FAN switch, the rehydration station hot 
and cold pushbuttons and quantity selector 
dial, and the MV2 valve. Six water heater strips 
on the hot water tank are energized when the 
two WATER HEATER switches are turned on. 
The OVEN/RHS switch controls power to the 
oven heaters and rehydration pumps and 
associated electronics. 


RHS controls 


On the lower right-hand side of the galley 
(above the MV2) is an auxiliary port water 
quick disconnect (AUX PORT QD) that allows 
the crewmembers to access ambient to hot (70° - 
120° F) potable water when a 12-foot flex line 
and water dispensing valve are attached to the 
OD. The MV2 valve, located below the AUX 
PORT QD, allows the crew to control the 
temperature of water (hot to ambient) out of the 
AUX PORT. The galley also has a test port 
(under the rehydration station) and a canon 
plug (by the oven latch) that are used for 
ground operations. 


Storage (straws) 


Disinfectant 
wipes 


Oven fan switch 


Aux port 


Oii Water heater switches 


Oven RHS switch 


Shuttle Galley 


2. SYSTEMS 
2.12 Galley / Food 


2.12-2 


Volume A - Pantry 


Volume A holds a hodgepodge of items in two 
half trays and two quarter trays stowed upside 
down. Snack foods, such as almonds, dried 
apricots, butter cookies, candy-coated nuts, 
candies, granola bars, peanut butter, and dried 
beef, are stowed in the first tray. This "free-for- 
all" food is available to anyone at any time and 
tends to be very popular. The second tray of 
volume A contains all the entry day weather 
wave-off entrees. Unlike the menu food that is 
packed by meals and itemized with labels, this 
food is stuffed into the tray in a jumble. 
Crewmembers are free to swap out their 
planned meals during the mission with items 
from this tray. The third and fourth trays hold 
extra drink bags апа beverages, straws, 
condiments and utensils. The extra drink bags 
are for drinking water. Drinking straws can be 
removed from this tray and temporarily stowed 


Disinfectant Wipes 
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in the storage compartment of the galley for 
easy access. Each crewmember is provided 
with one set of utensils, which includes a knife, 
fork, tablespoon, and a small pair of scissors, for 
the entire flight. 


About 6 months before a flight, crewmembers 
attend a food tasting provided by the food 
systems group (SF3) to sample and rate every 
food and drink item, including reentry kits. 
Several weeks later, crewmembers individually 
meet with a dietitian to develop their personal 
menus for the flight. Choices are based on the 
crewmember's preferences from the tasting and 
on the dietitian's nutritional and caloric 
recommendation. Generally, the food supply is 
more than adequate because about 30 to 50 
percent of all the food manifested for flight 
returns unopened. The food systems people 
make a good effort to accommodate special 
requests for favorite and ethnic foods. 


Vitamins 


Salt, Pepper, and Toothpicks 
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Food System Accessories 


Accessories consist of gum and candy, vitamins, 
disinfectant wipes, and the galley adapter. The 
galley adapter is a removable piece of the galley 
slide/adapter mechanism. The disinfectant wipes are 
a COTS product that allow crewmembers to clean 
their eating utensils. Each package contains 26 
wipes and is fitted with Velcro patches that allow its 
installation on the front of the galley. Packages are 
stowed for launch and noted on the Consumables 
Cue Card for replenishment, as needed. 


Reentry Kits 


The reentry kits, also known as fluid loading 
kits, contain either empty drink bags and salt 
tablets, chicken consommé (drink) packets, or 
Astroade packets (like Gatorade without sugar). 
Crewmembers must consume a certain amount 
of water and salt tablets, depending on their 
body weight, prior to entry to aid in their 
readjustment to one g. 


Trays 


The trays consist of a flat piece of aluminum with 
magnets and Velcro patches for holding utensils, 
food, and drink packets. Crewmembers either 
can Velcro the trays to a wall (ceiling/floor) or 
can strap the trays to one of their legs for use. The 
strap on the bottom side has been modified so 
that it fits over the right or the left thigh (not 
both). 


593-04496 
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Top of Tray 


Bottom of Tray 
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Description 


Guidance is the computation of corrective ac- 
tions to change from the navigation-determined 
vehicle state to a required vehicle state. The 
required state depends on particular mission 
requirements, which usually specify a required 
present state (e.g., a particular orbit) or an 
objective (e.g., rendezvous at a point in space) 
from which the present required state can be 
computed. 


Navigation is the determination of the state of 
motion of the vehicle; ie., position, velocity, 
and attitude. This state is determined with 
reference to some  mission-dependent 
coordinates suitable for defining the motion of 
the vehicle. 


Control is the application of corrective maneu- 
vers to obtain the changes commanded by guid- 
ance. Flight control for the orbiter converts 
guidance computations into effector commands 
to point and translate the vehicle. Control soft- 
ware frequently uses navigation data to deter- 
mine the effectors used and the appropriate 
system control gains. 


State Vector 


The basic function of the orbiter navigation 
system is to maintain an accurate estimate of 
the inertial position and velocity of the vehicle, 
called its state vector, with respect to time. In 
addition, during a rendezvous mission, the 
navigation system must maintain an estimate of 
a target's position and velocity. This infor- 
mation is then used by the onboard guidance 
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system to compute the commands required to 
transfer the vehicle from one position and 
velocity to another, as well as to point the 
vehicle at a specified target (Earth, Sun, another 
orbiting vehicle, etc.). The state vector data are 
also used by the ground controllers for moni- 
toring the status of the onboard navigation 
system. Information about the orbiter and 
target state vectors is displayed to the crew on 
the dedicated displays and GNC DPS displays. 


The navigation system tracks the orbiter's posi- 
tion and velocity with six parameters (X, Y, Z, 
Vx, Vy, Vz) that define the state vector. A time 
tag is also associated with this state vector. The 
X, Y, Z components are the orbiter's position in 
the Mean of 1950 (M50) coordinate system 
measured in feet from the center of the Earth. 
The velocity components are measured in feet 
per second, and are also in the M50 coordinate 
system. The time at which the state vector is 
applicable is based on Greenwich mean time 
(GMT). 


The navigation system uses the standard 
equations of motion along with the information 
received from the inertial measurement units, 
the navigation sensors, and the software models 
of the forces acting on the orbiter (gravity, drag, 
vents, etc.) to predict the components of the 
state vector at each time value. This process is 
called state vector propagation, a scheme in 
which errors are inherent. The equations of 
motion and the propagation technique are 
approximations, as are the gravity, drag, and 
vent models. Іп addition, the acceleration, 
position, and range rate information received 
from the inertial measurement units and the 
navigation sensors is also prone to error. To 
correct these errors, which increase with time, 
the ground controllers periodically uplink a 
new state vector or a delta to the current 
onboard state based upon the more accurate 
ground radar tracking data. 


The release of OI-27 flight software (FSW) 
began the process of replacing the orbiter 
tactical air navigation (TACAN) system with a 
global positioning system (GPS). GPS provides 
the navigation system with an alternate source 
of orbiter state vector data throughout the orbit 
and entry phases of flight. Currently, there is a 
mixed fleet of either triple-string GPS or triple 
string TACAN with a single GPS receiver. 
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OV-105 is the only vehicle that has triple-string 
GPS installed. This section addresses both 
triple-string TACAN and triple-string GPS 
configurations. 


ZM50 


XM50 
mean vernal 
equinox 


WARNING 


Control software uses state vector 
information to select control effectors and 


set control gains, especially during entry. 
Large navigation errors can cause the 
orbiter to depart controlled flight. 
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Starball Coordinate System 
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Coordinate Systems 


The position and velocity of the orbiter must be 
uniquely defined in terms of an inertial coordi- 
nate system - a reference frame that is neither 
rotating nor accelerating. Such a system 
ensures that the normal equations of motion are 
valid. The onboard navigation system uses the 
M50 inertial system. However, some 
computations are considerably simpler if 
performed in other coordinate systems. For 
example, when landing the orbiter, the position 
of the vehicle relative to the runway is more 
meaningful than its position in a coordinate 
system fixed in space. Therefore, the onboard 
navigation system uses a number of different 
coordinate systems to simplify the various 
inputs, outputs, and computations required. 
These inputs and outputs can be expressed in 
any coordinate system by using coordinate 
transformations resident in the navigation 
software. 


АП the coordinate systems referenced are right- 
handed Cartesian systems. These right-handed 
systems have three mutually perpendicular axes, 
sequentially ordered such that each axis satisfies 
the application of the right-hand rule to the other 
two axes (XYZ system: applying right-hand rule 
to X-Y yields Z, to Y-Z yields X, and to Z-X yields 
Y). 


Body Axis Coordinate System 


The body axis coordinate system maintains the 
origin at the orbiter's center of mass with the 
three axes stemming from that point. The X axis 
is parallel to the Хо axis of the orbiter structural 
body (orbiter + external tank + solid rocket 
boosters) and lies in the orbiter plane of 
symmetry. The positive direction is toward the 
nose. The Z axis lies in the orbiter plane of 
symmetry and is perpendicular to the X axis. 
The positive direction is opposite the payload 
bay. The Y axis completes the right-handed 
orthogonal system and points out of the right 
wing. Note that vehicle pitch is a rotation about 
the Y body axis, roll is a rotation about the X 
body axis, and yaw is a rotation about the Z body 
axis. 


M50 Coordinate System 


The inertial coordinate system used by the 
onboard navigation system is the Aries Mean of 
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1950 Cartesian system, generally called the M50 
system. The M50 system is used to establish 
and maintain the inertial position and velocity 
of the orbiter during all flight phases. The X 
axis points toward the mean vernal equinox (the 
apparent point on the celestial sphere where the 
Sun crosses the Earth's equator on its northward 
journey) of the year 1950. The Z axis points 
along Earth's mean rotational axis of 1950 with 
the positive direction toward the North Pole. 
The Y axis completes the right-handed system, 
with the corresponding X-Y plane lying in the 
plane of the equator. Note that this is an inertial 
system and, although its origin is at the Earth's 
center, the M50 system is completely 
independent of the Earth's rotation. 


451.cvs 


Body Axis Coordinate System 


Starball Coordinate System 


The Starball coordinate system, a variation of 
the M50 system, is described by rotating the 
M50 system by 90° about the X axis. The 
Starball orientation makes the pitch angle 
equivalent to the right ascension and the yaw 
angle equivalent to declination, thus 
simplifying maneuvers to point at stars. This 
coordinate system is seldom, if ever, used. 


Local Vertical/Local Horizontal 
Coordinate System 


Тһе local vertical/local horizontal (LVLH) 
coordinate system is an orbiter-centered system. 
The positive Z axis points toward the center of 
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the Earth along the geocentric radial vector of 
the vehicle. The positive Y axis points toward 
the negative angular momentum vector of the 
vehicle's orbit. The X axis completes the right- 
hand rule with positive X along the vehicle's 
direction of motion in the orbital plane. The 
LVLH system allows the crew to see the attitude 
of the orbiter in relation to the Earth's surface. 
It is not an inertial system, because it rotates at 
approximately 4 deg/min with respect to the 
inertial frame. 


Runway Coordinate System 


For launch, landing, and Earth observation, it is 
advantageous to know the orbiter's position and 
velocity in coordinate systems fixed to the 
Earth. These non-inertial systems are related to 
the M50 system by transformations that depend 


Vehicle 
orbital 
plane 


еосепігіс radius 
vector of vehicle 


on time, Earth rotation rate, and the latitude 
and longitude of the point of interest. The 
runway coordinate system is a good example of 
an Earth-fixed reference frame. The origin of 
the system is placed at the runway center at the 
approach threshold. The Z axis is normal to the 
ellipsoid model through the runway centerline 
and positive toward the center of the Earth. The 
X axis is perpendicular to the Z axis and lies ina 
plane containing the Z axis and the runway 
centerline (positive in the direction of landing). 
The Y axis completes the right-hand rule. Note 
that A is the runway azimuth measured in the X- 
Y plane from true north to the positive X axis 
(positive clockwise). The runway coordinate 
system is used by navigation and the crew 
during ascent, entry, and landing phases of 
flight. 


Direction of 
motion 


+YLVLH 


LVLH Coordinate System 
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Guidance, Navigation, and Control Software 


Guidance, navigation, and control (GNC) 
software commands the GNC system to effect 
vehicle control and to provide sensors and 
controllers with the data needed to compute 
these commands. The process involves three 
steps: 


1. Navigation tracks the vehicle's actual 
location. 


2. Guidance equipment and software 
compute the orbiter location required 
to satisfy mission requirements. 


3. Flight control transports the orbiter to 
the required location. 


During launch and ascent, most of the GNC 
commands are directed to gimbal the three 
SSMEs and two SRBs to maintain thrust vector 
control. The GNC software also controls SSME 
burns for maximum aerodynamic loading of the 
vehicle during ascent, referred to as max д. To 
circularize the orbit and perform on-orbit and 
deorbit maneuvers, the GNC software com- 
mands the orbital maneuvering system (OMS) 
engines. At external tank separation, on orbit, 
and during portions of entry, GNC controls 
commands to the reaction control system (RCS). 
In atmospheric flight, GNC controls the orbiter 
aerodynamic flight control surfaces. 


Guidance, Navigation 


and Control Hardware | SNE Software 


Earth-relative position and velocity 
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Control Modes 


The GNC system consists of two operational 
modes: automatic and control stick steering 
(CSS). In the automatic mode, the primary 
avionics software system (PASS) essentially 
allows the GPCs to fly the vehicle. The flight 
crew may control the vehicle in the CSS mode 
using hand controllers, such as the rotational 
hand controller. In the CSS mode, flight crew 
commands must still pass through and be issued 
by the GPCs. There are no direct mechanical 
links between the flight crew and the orbiter's 
various propulsion systems or aerodynamic 
surfaces. The orbiter is an entirely digitally 
controlled, fly-by-wire vehicle. 


Navigation Hardware 


The navigation system uses measurements from 
onboard sensors to improve its estimate of the 
state vector. These sensors and the physical 
data they sense include: 


e Inertial measurement unit (IMU) -- 
Senses vehicle attitude in inertial space 
and accelerations along inertial axes. 


e Star trackers -- Sense vehicle line of sight 
vectors to stars or orbiting target. 


* Not used by Navigation 
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е Crew optical alignment sight (COAS) -- 
Allows the crew to visually align the 
vehicle line of sight to stars or orbiting 
targets. The head-up display (HUD) 
test pattern also allows the crew to 
align the vehicle line of sight to the 
stars. The HUD serves as the backup 
to the star trackers. 


e Tactical air navigation (TACAN) -- 
Senses vehicle position with respect to a 
ground-based TACAN station. 


e Air data system -- Senses air temp- 
erature and pressure in free stream and 
air disturbed by vehicle. 


e Microwave landing system (MLS) -- 
Senses vehicle position with respect to 
ground stations alongside the landing 
runway. 


e Radar altimeters (RA) -- Senses vehicle 
altitude above the ground. 


e GPS - Senses satellite ranging signals to 
determine position and velocity. 


NOTE 
Radar altimeter altitude is not used for 
navigation or guidance. The information 
is displayed for the crew to monitor. 


Each piece of navigation hardware is hard-wired 
to one of eight flight-critical multiplexer/demul- 
tiplexers (MDMs) connected to each of five GPCs. 
Several navigation system parameters can be 
monitored at the lower right-hand corner of the 
GNC SYS SUMM 1 display (DISP 18). 


Inertial Measurement Units 


There are three IMUs on the orbiter. Each 
contains three accelerometers and two two-axis 
gyros mounted on an inertially stabilized four- 
gimbal platform. The IMUs provide inertial atti- 
tude and velocity data to the GNC software 
functions. Navigation software uses the pro- 
cessed IMU velocity and attitude data to 
propagate the orbiter state vector. Guidance uses 
the attitude data, along with the state vector from 
the navigation software, to develop steering 
commands for flight control. Flight control uses 
the IMU attitude data to convert the steering 
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commands into control surface, engine gimbal 
(thrust vector control), and КС5 jet fire 
commands. 
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The HAINS IMU is 
9.24 inches high, 


Inertial Measurement Units 
Although flight could be accomplished with 
only one IMU, three units are installed on the 
orbiter for redundancy. The IMUs are mounted 
on the navigation base, which is located inside 
the crew compartment flight deck forward of 
the flight deck control and display panels. The 
base provides a platform on which the IMUs 
can be repeatedly mounted with great accuracy, 
enabling the definition of transformations that 
relate IMU reference frame measurements to 
any other reference frame. 


The IMU consists of a platform isolated from 
vehicle rotations by four gimbals. Since the 
platform does not rotate with the vehicle, its 
orientation remains fixed, or inertial, in space. 
The gimbal order from outermost to innermost is 
outer roll, pitch, inner roll, and azimuth. The 
platform is attached to the azimuth gimbal. The 
inner roll gimbal is a redundant gimbal used to 
provide an all-attitude IMU, while preventing the 
possibility of gimbal-lock (a condition that can 
occur with a three-gimbal system and can cause 
the inertial platform to lose its reference). The 
outer roll gimbal is driven from error signals 
generated by disturbances to the inner roll 
gimbal. Thus, the inner roll gimbal will remain 
at its null position, orthogonal to the pitch 
gimbal. 


The IMUs have three accelerometers, one on 
each of the X, Y, and Z axes. The accelerometer 
is basically a force rebalance-type instrument. 
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displacement is measured by a pick-off device, 
which generates an electrical signal that is 
proportional to the sensed acceleration. This 
signal is amplified and returned to a torquer 
within the accelerometer, which attempts to 
reposition the mass to its null position. 


The acceleration data measured Бу the 
accelerometers are the primary sources for the 
three position and three velocity components of 
the state vector used during ascent and entry. 
On orbit, a sophisticated drag model is 
substituted for IMU velocity information, 


except during large vehicle accelerations. 
During large on-orbit accelerations, IMU 
velocity data are used іп navigation 


calculations. 


The inertial sensors consist of two gyros, each 
with two degrees of freedom, mounted on the 
cluster platform. Angular motion about any 
axis perpendicular to the spin axis causes 
rotation about a third orthogonal axis, which is 
electrically sensed. In response to this sensed 
rotation, the appropriate gimbals are torqued to 
null the gyro rotation. This gimbal torquing in 
response to vehicle motion results in an 
inertially stabilized platform. In addition, the 
gyros may be pulse torqued (small angles) or 
slewed (large angles) by software, which results 
in gimbal torquing to position or reposition the 
platform. Each gimbal has a coarse (one-speed 
or 1X) resolver and a fine (eight-speed or 8X) 
resolver. The resolver readouts are sent to the 
data processing system, which determines the 
gimbal angles, which in turn determine the 
attitude of the orbiter. 


Azimuth 
gimbal 


Single-axis 


accelerometers 


When the accelerometer experiences ап 47 
acceleration along its input axes, it causes a IMU Platform Assembly 
pendulum | mass displacement. This 
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One gyro, the vertical gyro, is oriented so its 
input axes are aligned with the X and Y 
platform axes; its input axes provide IMU 
platform roll and pitch stabilization. The 
second gyro is oriented so that one input axis 
lies along the platform's Z axis, and the other 
lies in the X-Y plane. This gyro, the azimuth 
gyro, provides platform yaw stabilization with 
the Z input axis, while the second input axis is 
used as a platform rate detector for built-in test 
equipment. Each gyro contains a two-axis pick- 
off that senses deflection of the rotating wheel. 
The gyro also contains a pair of two-axis 
torquers that provide compensation torquing 
for gyro drift and a means to reposition the 
platform. 


The spin axis of a gyro is its axis of rotation. 
The inertial stability of the spin axis is a basic 
property of gyroscopes and is used in 
stabilization loops, which consist of the gyro 
pick-off, gimbals, and gimbal torquers. When 
the vehicle is rotated, the platform also tends to 
rotate due to friction at the gimbal pivot points. 
Because the gyro casing is rigidly mounted to 
the platform, it will also rotate. The gyro resists 
this rotation tendency to remain inertial, but the 
resistance is overcome by friction. This rotation 
is detected by the pick-offs as a deflection of the 
rotating gyro wheel. A signal proportional to 
this deflection is sent to the gimbal electronics, 
which route the signals to the appropriate 
torquers, which in turn rotate their gimbals to 
null the pick-off point. When the output is 
nulled, the loop is closed. 


Four resolvers in an IMU are used to measure 
vehicle attitude. A resolver is located at one of 
two pivot points between adjacent gimbals. The 
IMU resolvers are electromechanical devices that 
apply the principle of magnetic induction to 
electrically measure the angle between two 
adjacent gimbals. This electrical signal is then 
transformed into a mechanical angle by the IMU 
electronics. 


The single gimbal angle measurements are used 
to determine vehicle attitude. Attitude 
information is used by flight control for turn 
coordination and steering command guidance. 
An attitude director indicator (ADI) displays 
attitude and navigation data. 


Platform attitude can be reoriented by slewing 


or pulse torquing. Slewing rotates the platform 
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at a high rate (1.2° per second), and pulse 
torquing rotates it very slowly (.007° per 
second). Platform reorientation relies on 
another property of gyroscopes: precession. If 
a force is applied to a spinning gyroscope, the 
induced motion is 90° from the input force. In 
each IMU, a two-axis torquer is located along 
the input axes of both gyros. Commands are sent 
to the torquers from the GPC to apply a force 
along the input axes. The result is a deflection of 
the gyro spin axis that is detected and nulled by 
the stabilization loops. Because the gyro spin 
axis is forced to point in a new direction, the 
platform has to rotate to null the gyro outputs. 


The three IMUs have skewed orientations: their 
axes are not co-aligned and not aligned with the 
vehicle axes. This is done for two reasons. First, 
gimbaled platforms have problems at certain 
orientations. Skewing ensures that no more than 
one IMU will have an orientation problem for a 
given attitude. Second, skew allows resolution of 
a single-axis failure on one IMU by multiple axes 
on another IMU since the possibility of multiple- 
axis failure is more remote. Skewing is also used 
by redundancy management to determine which 
IMUs have failures. 


Inertial measurement 


= units > 
Star а 
tracker “2, 


Navigation 
ba: 


— 


tracker 


IMU Skew 


Each IMU contains heaters, temperature 
sensors, and built-in test equipment (BITE). 
Very precise thermal control must be 
maintained in order to meet IMU performance 
requirements. The IMU thermal control system 
consists of an internal heater system and a 
forced-air cooling system. The internal heater 
system is completely automatic and is activated 
when power is initially applied to the IMU. It 
continues to operate until the IMU is powered 
down. The forced-air cooling consists of three 
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continues to operate until the IMU is powered 
down. The forced-air cooling consists of three 
fans that serve all three IMUs. Each IMU fan is Е 
controlled by ап individual IMU FAN switch а а | 
located оп panel 11. Only one fan is used аға | | 

time; three are provided for redundancy. TU ow 


Each IMU is supplied with redundant 28-volt cn зе 
dc power through two separate remote power 
controllers. The IMU 1, 2, and 3 power switches 2 
аге located on panels O14, O15, and O16. Loss a 2 
of one control bus or one main bus will not 
cause the loss of an IMU. 


Each IMU has two modes of operation, a 
warmup/standby mode and an operate mode. жа) Ny (ха 
When an IMU switch is positioned to ОМ, the ТӨ [e 
IMU is powered in the warm-up/standby mode, ——€—— B aod 
which applies power only to the heater circuits. pS EE 
It takes approximately 8 hours from cold start for (Oi 
the IMU to reach its operating temperature 
range, at which time the IMU enters a standby 
mode. A software command in GNC OPS 2, 3, or 
9 transitions the IMU to the operate mode. To 
mode the IMU to operate, the controlling GPC 
sends the operate discrete to the IMU through the 
flight forward MDM. The IMU, upon receiving 
this command, initiates its run-up sequence. 


The run-up sequence first cages the IMU, a 
process of reorienting the IMU gimbals and 


ol 
then mechanically locking them into place so ІШ 
that the gyros may begin to spin. When the —X— 
IMU is caged, its platform orientation is known For 174° CONO 172 1 oF 1/2 oF а 
А А А А 


when it becomes inertial. The caged orientation 
is defined as the point at which all resolver 
outputs are zero. Inner roll and azimuth must 
always be at 90° angles to each other. 


ГҮ әт T (а Тү 


IMU 1 Power Switch on Panel O14 
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IMU 3 Power Switch on Panel O16 


Once the IMU gimbals are caged, the gyros 
begin to spin, and power is applied to the 
remaining IMU components. When the gyros 
have reached the correct spin rate, the 
stabilization loops are powered, and the IMU 
becomes inertial. At this time, the IMU returns 
an in-operate-mode discrete to the GPC, 
indicating that the run-up sequence is complete. 
This process requires approximately 85 seconds. 


The IMUs are in operate by the time the flight 
crew enters the vehicle before launch and remain 
in that state for the duration of the flight, unless 
powered down to minimize power consumption. 
While in the operate mode, the IMU maintains its 
inertial orientation and is used for calibration and 
preflight, on-orbit, and entry alignments. 


During ascent, the IMUs provide accelerometer 
and resolver data to the GNC software to 
propagate the state vector, determine attitude, 
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and display flight parameters. During the 
orbital flight phase, the IMUs provide GNC 
software with attitude and accelerometer data. 
On-orbit alignments are necessary to correct 
platform misalignment caused by 
uncompensated gyro drift. During entry, IMU 
operation differs only in the manner in which 
accelerometer data are used by navigation. 


The IMUs can be safely powered off from either 
the warmup/standby mode or the operate 
mode. A braking system is used to ensure that 
the gyros have slowed to a stop. 


The IMU software scheme is designed to select 
the best data for GPC use and to detect system 
failures. This scheme is referred to as 
redundancy management. IMU parameters can 
be accessed using the IMU ALIGN display 
(SPEC 21) and the GND IMU CNTL/MON 
display (SPEC 104)(GNC OPS 9 only). 


// зо117021/ IMU ALIGN 1 006/09:34:09 
I 000/00:00:00 
1 2 3 
STAT IGN 
OK CK CK IMU 1 10 STAR ALIGN 13* 
STBY 21 22 23 2 11 14 IMU/IMU 
OPER 4* 59 6% 3 12 MATRIX 15 
DES 7 8 9 
EXEC 16 
TERM 17 
acc 
1 2 3 


Х -0.03 +0.01 -0.03 IMU BITE MASK 


y -0.02 -0.01 +0.03 1 0000 24 
2 -0.01 -0.02 -0.03 2 0000 25 
3 0000 26 


АМС 
1 2 3 

Х 299.07 299.16 299.12 
Ү 339.17 339.09 339.14 
2 160.65 160.72 160.64 
%0.00 +0.00 
+0.00 +0.00 
+0.00 +0.00 


МАУ АУ THRESH 
18 3840 


ММ READ 19 


usa007587 463.14 


IMU ALIGN Display (SPEC 21) 


ұз 9011/104/ GND IMJ CNTL/MON 2 150/12:20:13 


000/00: 44: 47 
IMJ 1 2 3 
x 1 0,00 4. 0.00 7 0,00 SEL IM 1 16* 
Y 2 0.00 5 0.00 8 0.00 217 
2 3 0.00 6 0.00 9 0.00 3 18% 
о 83.62 192.88 297.47 АТТ DET 19 
M 23.65 301.81 26.65 HNGR CAL A 20 
I 99.91 42.01 351.09 B21 
IR 0.00 0. 00 0.00 С 22 
DV Х -10.72 ж 9.50 »25.73 РКЕШТ CAL 23 
Y «27.14 + 6.88 - 9.28 GYROCOMP 24 
2 -13.24 +29.74 16.57 
DVRSS 32.04 31.96 31.98 INERTIAL 25% 
PLAT POS 26 
HDW 8000 8000 8000 TERM/IDLE 27 
ам 00 00 00 
'АТ ЗР ЗР ЗР 28 ММ WRITE 1 
READ 29 
PWR ОМ ы * * MM STATUS 
I/O 


30 SITE SEL 7 
ACTUAL зэв 


usa007587 4641 
GND IMU CNTL/MON Display (SPEC 104) 
(available in OPS 9 only) 
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In the event of an IMU dilemma, the IMU 
caution and warning light on panel F7 will be 
illuminated. (The light will not illuminate for a 
redundancy management fail.) If temperatures 
are out of limits or if BITE detects a failure, a 
fault message (IMU BITE/T X) and SM ALERT 
will be annunciated. 


The accuracy of the IMU deteriorates with time. 
If the errors are known, they can be physically 
or mathematically corrected. Software based on 
preflight calibrations is used to compensate for 
most of the inaccuracy. The star trackers are 
used to determine and correct additional errors. 


The IMU subsystem operating program (SOP) 
processes and converts the data from the IMUs. 
The following computations are performed in 
the IMU SOP: conversion of velocities to the 
M50 coordinates; conversion of resolver outputs 
to gimbal angles; computation of accelerations 
for displays; performance of additional software 
BITE checks; support of selection, control, and 
monitoring of IMU submodes of the operate 
mode; and computation of torquing commands, 
based on the misalignment determined by the 
star trackers or another IMU. Typical 
misalignments are due to gyro drifts. 


Star Trackers 


The star tracker system consists of the negative Y 
axis tracker and the negative Z axis tracker. They 
are located just forward and to the left of the 
commander's plus X window in a well outside 
the crew compartment, an extension of the 
navigation base on which the IMUs are mounted. 
The star trackers are slightly inclined off the 
vehicle axes for which they are named. The star 
trackers are used to align the IMUs onboard the 
orbiter, as well as to track targets and provide 
line-of-sight vectors for rendezvous calculations. 
The GPC memory contains inertial information 
for 100 stars in OPS 2 and 50 stars in OPS 3. The 
stars are chosen for their brightness and their 
ability to provide complete sky coverage. 


The star trackers are oriented so that the optical 
axis of the negative Z star tracker is pointed 
approximately along the negative Z axis of the 


2.13-11 


USA007587 
Rev. A 


orbiter, and the optical axis of the negative Y 
star tracker is pointed approximately along the 
negative Y axis of the orbiter. Since the 
navigation base provides the mount for the 
IMUs and star trackers, the star tracker line of 
sight is referenced to the navigation base and 
the orbiter coordinate system; thus, the GPC 
knows the star tracker's pointing direction and 
its orientation with respect to the IMUs. 


Each star tracker has a door to protect it during 
ascent and entry. The doors are opened on orbit 
to permit use of the star trackers. To enable the 
star tracker doors to open, the STAR TRACKER 
POWER -Y and -Z switches on panel O6 must 
be positioned to ON. The STAR TRACKER 
DOOR CONTROL SYS 1 and SYS 2 switches on 
panel O6 control two three-phase ac motors on 
each door. Positioning the SYS 1 switch to 
OPEN controls motor control logic and drives 
Ше -Y and -Z яаг tracker doors by 
electromechanical actuators to the open 
position. Limit switches stop the motors when 
the doors are open and control talkback 
indicators above the DOOR CONTROL 
switches. Setting the SYS 2 switch to OPEN 
controls redundant ас motors апа 
electromechanical actuators to open both doors. 
Limit switches stop the motors when the doors 
are open and control the same two talkback 
indicators above the DOOR CONTROL SYS 1 
and SYS 2 switches. Normally, both the SYS 1 
and SYS 2 switches are used together to actuate 
the star tracker doors. 


Positioning the SYS 1 switch to CLOSE drives the 
system 1 motors and closes the -Y and -Z doors; 
the talkback indicators above the switches 
indicate CL. Setting the SYS 2 switch to CLOSE 
drives the system 2 motors and closes the -Y and - 
Z doors; the talkback indicators above the 
switches indicate CL. The indicators are 
barberpole when a door is between open and 
closed. The door opening or closing time with 
two motors is 6 seconds; with one motor, it is 12 
seconds. 


The OFF position of the SYS 1 or 2 switch 
removes power from the corresponding motor 
control logic circuitry. 
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The star trackers are used to align the IMU inertial 
platforms. A star tracker searches for, acquires, 
and tracks stars whose approximate position is 
determined by the IMUs. By knowing the 
relationship of the star tracker to the orbiter and 
the location of the star in space, a line-of-sight 
vector from the orbiter to the star is defined. Two 
such vectors define the orbiter inertial attitude. 


The difference between the inertial attitudes 
defined by the star tracker and the IMU is pro- 


cessed by software and results in IMU torquing 
angles. If either the IMU gimbals are physically 
torqued or the matrix defining its orientation is 
recomputed, the effects of the IMU gyro drift 
are removed, and the IMU is restored to its 
inertial attitude. If the IMU alignment is in 


error by more than 1.4°, the star tracker may be 
unable to acquire and track stars. In this case, 
the HUD must be used to realign the IMUs to 
within 1.4°; the star trackers can then be used to 
realign the IMUs more precisely. 
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STAR TRACKER Controls and Talkbacks 
on Panel O6 


NOTE 


The star tracker cannot be used if the IMU 
alignment error is greater than 1.4? 
because the angles the star tracker is 
given for searching are based on current 
knowledge of the orbiter attitude, which 
is based on IMU gimbal angles. Ш that 
attitude is greatly in error, the star tracker 
may acquire and track the wrong star. 


In addition to aligning the IMUs, the star trackers 
can be used to provide angular data from the 
orbiter to a target. This capability can be used 
during rendezvous or proximity operations. 


The star tracker includes a light shade assembly 
and an electronics assembly mounted on top of 
the navigation base. The light shade assembly 
defines the tracker field of view (10? square). Its 
shutter mechanism may be opened manually by 
the crew using an entry on the 5 TRK/COAS 
CNTL display, or it can be opened and closed 
automatically by a bright object sensor or target 
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suppress software. The bright object sensor 
reacts to close the shutter before a bright object, 
such as the Sun or Moon, can damage the star 
tracker (the sensor has a larger field of view 
than the star tracker shutter). 


There are two types of star trackers used by the space 
shuttle program, a solid state star tracker (SSST) or 
an image dissector tube (IDT) star tracker. 
Currently, there is a mixed fleet of star trackers 
installed on the three orbiters. Each star tracker 
contains an electronics assembly mounted on the 
underside of the navigation base. The star 
tracker itself does not move; the field of view is 
scanned electronically. The star tracker may be 
commanded to scan the entire field of view or a 
smaller offset field of view (1° square) about a 
point defined by horizontal and vertical offsets. 
An object is tracked when the correct location is 
sensed. Star tracker outputs are the horizontal 
and vertical position within the field of view of 
the object being tracked and its intensity. 


There is no redundancy management for the 
star tracker assemblies. They operate inde- 
pendently and can do the entire task. They can 
be operated either separately or concurrently. 


The star tracker SOP supports the modes that 
are commanded manually from SPEC 22 5 
TRK/COAS CNTL: self-test, star track, target 
track, break track, and term/idle. Self-test con- 
sists of software and hardware tests. In the star 
track mode, the star tracker does an offset scan 
search for the star, acquires it, and tracks it. The 
star may be selected by the flight crew or GPC; 
in either case, a field-of-view check is made. 
Target track is the same as star track, but it 
tracks a target. Threshold is independent of 
target track. Break track forces the star tracker 
to stop tracking a star or target and to perform а 
search scan from the current location to track 
the next target it acquires. In the term/idle 
mode, the star tracker hardware continues 
operation, but star tracker software processing 
ceases. ш addition, the star tracker SOP 
maintains the star table. When a star tracker 
has acquired and tracked a star, and the data 
have passed software checks, the star 
identification, time tag, and line-of-sight vector 
are stored. The identification and time elapsed 
since time tag are displayed in the star table. 
When two or three stars are in the table, the 
angular difference between their line-of-sight 
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vectors is displayed. The difference between 
the star tracker and star catalog angular 
differences is displayed as an error. The star 
tracker SOP selects line-of-sight vectors of two 
stars in the star table for IMU alignment and 
outputs an ALIGN ENA discrete. The software 
selects the star pair whose angular difference is 
closest to 90°, as long as the difference is between 
35° - 145°. 


The flight crew may manually override the SOP 
selection or clear the table if desired. The SOP 
also determines and displays star tracker status. 
Star tracker parameters are accessible to the crew 
on the S TRK/COAS CNTL display (SPEC 22). 


f 3011/022/ 


$ ТЕК CNTL -Y -2 
SELF-TEST 1 2 
STAR TRK 3 4 
TGT TRK 5 6 
BREAK TRK 7 8 
TERM/IDLE 9* 10 


S TRK/COAS CNTL 1 006/09:35:06 
000/00:00:00 

S TABLE 1 2 3 
TRK ID 15 43 0 
A MIN 1 1 0 
ANG DIF 84.1 0.0 0.0 
ERR 0.02 0.00 0.00 


* 


SEL 17* 18* 19 
S TABLE CLR 20 


S TRK -Y -Z COAS 
REQD ID 11. 0 12 —0 REQD ID 21 0 
TRK ID 0 0 ADEG X -0.2 
S PRES Y «0.3 
NG «0.00 *0.00 SIGHT MODE 22 
THOLD 1 0 14 0 АССЕРТ 23 
SHUTTER cL cL CAL MODE 24 
MAN OP 15 16 DES 25 
STATUS POS +Х 26 -2 27, 
АВІА5 0.00 0.00 
ОРРАТЕ 28 9 
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S TRK/COAS CNTL Display (SPEC 22) 


Forward (-Х) 


Outboard (-Y) 
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Crew Optical Alignment Sight 


The COAS is an optical device with a reticle 
focused at infinity projected on a combining 
glass. The reticle consists of a 10?-wide circle 
with 1? marks. А light bulb with variable 
brightness illuminates the reticle. The COAS 
requires 115-volt ac power for reticle 
illumination. The COAS is 9.5 by 6 by 4.3 
inches and weighs 2.5 pounds. 


The COAS can be used if IMU alignment is in 
error by more than 1.4°, rendering the star 
tracker unable to acquire and track stars, but, 
primarily, the HUD is used. 


The COAS can be mounted at either the 
commander's station to view along the +X axis 
or next to the aft flight deck overhead starboard 
window to view along the -Z axis. To use the 
COAS or HUD, the flight crewmember must 
manually maneuver the orbiter until the 
selected star is in the field of view. The 
crewmember then maneuvers the orbiter so that 
the star crosses the center of the reticle or the "P" 
in the HUD test pattern. At the instant of the 
crossing, the crewmember enters a mark by 
depressing the most convenient of the three 
ATT REF pushbuttons located on panels F6, F8, 
and A6U. At the time of the mark, software 
stores the gimbal angles of the three IMUs. This 
process can be repeated if the accuracy of the 
star's centering is in doubt. When the 
crewmember feels a good mark has been taken, 
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Navigation 
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the software is notified to accept it. Good marks 
for two stars are required for an IMU 
alignment. The separation between the two 
stars should be between 60° and 120°. 


NOTE: 

RETICULE 

SHOWS SCALES 

FOR ILLUSTRATIVE 
PURPOSES ONLY 


RETICAL PATTERN 


COAS Reticle Pattern 


By knowing the star being sighted and the HUD 
or COAS's location and mounting relationship 
in the orbiter, software can determine a line-of- 
sight vector from the HUD/COAS to the star in 
an inertial coordinate system. Line-of-sight 
vectors to two stars define the attitude of the 
orbiter in inertial space. This attitude can be 
compared to the attitude defined by the IMUs; 
if an error exists, the IMUs can be aligned to the 
correct orientation. 


The COAS's mounting, relative to the 
navigation base on which the IMUs are 
mounted, is calibrated before launch. The 
constants are stored in software, and COAS 
line-of-sight vectors are based on known 
relationships between the COAS line of sight 
and the navigation base. These constants are 
usually updated by the crew on orbit using a 
calibration mode to mark on a star while the 
IMUs are known to be correctly aligned. The 
HUD is consistent and, generally, needs no 
calibration. 
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The COAS can also be used to visually track targets 
during proximity operations or to visually verify 
tracking of the correct star by the -Z star tracker. 


COAS data processing is accomplished in the 
star tracker SOP. This SOP accepts and stores 
crew inputs on COAS location, star identifica- 
tion, or calibration mode, accepts marks, com- 
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putes and stores the line-of-sight vectors, en- 
ables IMU alignment when two marks have 
been accepted, and computes, updates, and 
provides display data. COAS parameters may 
be accessed using the S TRK/COAS CNTL 
(SPEC 22) display (lower right). 


Tactical Air Navigation 


The onboard TACAN units determine slant 
range and magnetic bearing of the orbiter to a 
TACAN ог УНЕ omnirange tactical air 
navigation (VORTAC) ground station. 


The ground-based TACAN and VORTAC sta- 
tions constitute a global navigation system for 
military and civilian aircraft operating at L-band 
frequencies (1 GHz). The TACAN unit includes 
a transmitter, a receiver, and a data processor. 
The data processor decodes the selected channel 
and sends the frequency to the receiver. 


Vehicles without the three-string GPS upgrade 
are equipped with three ТАСАМ5 that operate 
redundantly. Each TACAN has two antennas, 


one on the orbiter's lower forward fuselage and 
one on the orbiter's upper forward fuselage. 
Ihe antennas are covered with thermal 
protection system tiles. Тһе three passive- 
cooled ТАСАМ$ are located in the orbiter crew 
compartment middeck avionics bays. The 
onboard TACANs are used to obtain orbiter 
position data from an external source during 
entry. | TACAN's maximum range is 400 
nautical miles (n. mi.) Each set is 7.62 inches 
high, 7.62 inches wide, and 12.53 inches long 
and weighs 30 pounds. 


Each ground station has an assigned frequency 
(L-band) and a three-letter Morse code identifi- 
cation. The ground station transmits on one of 
252 (126Х, 126Y) preselected frequencies 
(channels) that correspond to the frequencies the 
onboard TACAN sets are capable of receiving. 
These frequencies are spaced at 63-MHz intervals. 
The TACAN ground station beacon continu- 
ously transmits pulse pairs on its assigned fre- 
quency. The orbiter TACAN receivers pick up 
these pulse pairs, and the TACAN data proces- 
sors decode them to compute bearing. The on- 
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board TACAN sets detect the phase angle 
between magnetic north and the position of the 
orbiter with respect to the ground station. The 
ground beacon is omnidirectional. When the 
orbiter is over the ground station, or nearly so, 
it is in a cone of confusion. Within this cone, 
bearing is unusable. 


Periodically, the onboard TACAN sets emit an 
interrogation pulse that causes the selected 
TACAN ground station to respond with 
distance-measuring equipment pulses. The 
slant range (orbiter to ground station) is 
computed by the onboard TACAN sets by 
measuring the elapsed time from interrogation 
to valid reply and subtracting known system 
delays. As the orbiter approaches a ground 
TACAN station, the range decreases. After a 
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course has been selected, the onboard TACAN 
sets derive concise deviation data. 


The TACAN range and bearing data are used to 
update the state vector position components 
during entry. Range and bearing data are also 
displayed on the horizontal situation indicators 
(see section 2.7 for description), as well as on 
the GNC SPEC 50 HORIZ SIT display. 


TACAN controls are located at the top of panel 
O7. The TACAN 1,2,3 ANT SEL switches con- 
trol antenna selection. In the AUTO position, 
the onboard GPCs automatically select the best 
antenna for that TACAN. The UPPER and 
LOWER positions of the switches allow the 
flight crew to manually select the upper or 
lower L-band antenna. 
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Each TACAN also has a MODE rotary switch 
on panel O7. The modes are OFF, receive 
(RCV), transmit and receive (Т/К), and GPC. In 
the GPC mode, the onboard GPCs control 
TACAN ground station channel selection 
automatically, and both bearing and range are 
processed by hardware and software. In the 
T/R mode, both bearing and range are 
processed by hardware and software, but 
TACAN ground station channels are selected 
manually using the four CHANNEL 
thumbwheels for that TACAN on panel O7. 
The first three thumbwheels (left to right) select 
the channel (frequency), and the fourth selects 
the X or Y. In the RCV mode, only bearing is 
received and processed by the hardware; the 
thumbwheels for that TACAN are used to select 
the channel. 


Approximately every 37 seconds, the selected 
TACAN ground station transmits its three-letter 
identification to the onboard TACAN. In order 
for the Morse code identification to be verified 
by the commander and pilot, TACAN ID audio 
controls are located on panel O5 (designated 


LEFT AUDIO) for the commander and panel O9 
(designated RIGHT AUDIO) for the pilot. The 
TACAN ID ON/OFF switch is positioned to 
ON to receive the TACAN identification. The 
TACAN ID 1, 2, 3 switch selects the onboard 
TACAN that will transmit the TACAN identifi- 
cation code. VOLUME TACAN thumbwheels 
on panels О5 and O9 control the volume setting 
of the TACAN identification code to the com- 
mander and pilot. 


During entry, when at least two available 
TACANSs lock оп, TACAN range and bearing 
data are used by navigation software to update 
the state vector until microwave landing system 
(MLS) acquisition at approximately 18,000 feet. 


ТАСАМ azimuth and range (ТАС AZ, КМС) 
are provided on the lower left side of the 
HORIZ SIT display (SPEC 50). TACAN range 
and bearing data cannot be used to produce a 
good estimate of the altitude position 
component, so navigation uses barometric 
altitude derived from the air data system 
probes, which are deployed by the fight crew at 
approximately Mach 5. 
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HORIZ SIT Display (SPEC 50) 
(Three-String GPS Vehicles) 


If MLS is not acquired, TACAN data can be used 
until an altitude of 1,500 feet. When runways 
with MLS are acquired, MLS operation is 
automatic. The flight crew is provided with the 
controls and displays necessary to evaluate MLS 
performance and take over manually, if required. 


TACAN redundancy management consists of 
processing and mid-value-selecting range and 
bearing data. The three ТАСАМ№ are compared 
to determine if a significant difference is 
detected. When all three TACANs are good, 
redundancy management selects middle values 
for range and bearing. If a fault is detected, the 
SM ALERT light is illuminated, and a GPC 
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Global Positioning System 


The GPS is a relatively new navigation tool to 
the shuttle. Because of the anticipated 
decommissioning of TACAN stations by the 
Department of Defense (DOD), shuttle program 
officials decided to use GPS as the replacement 
for TACANs, which had been а primary 
navigational tool for entry. 


The NAVSTAR GPS is a space-based radio 
positioning navigation system that provides 
three-dimensional position, velocity, and time 
information to suitably equipped users 
anywhere on or near the surface of the Earth. 
The GPS constellation consists of 27 NAVSTAR 
satellites, including 3 active on-orbit spares. 
The satellites travel in 10,980 n. mi. orbits at 
velocities of 14,500 km/hr for periods of 12 
hours. These satellites are in six planes, each at 
an inclination of 55° with respect to the equator. 
NAVSTAR satellites and their support 
equipment are financed by the DoD, but their 
navigation signals are available free of charge to 
anyone. The NAVSTAR satellite constellation 
control center facility is located at Falcon Air 
Force Base in Colorado Springs, CO. 


The way a GPS receiver interacts with the 
NAVSTAR satellites to determine position and 
velocity is fairly straightforward. Each GPS 
satellite repeatedly transmits a specific sequence 
of codes. The receiver knows each satellite’s 
code pattern, as well as what time a satellite is 
supposed to transmit specific parts of the code. 
After identifying a specific satellite (via code- 
matching techniques), the GPS receiver 
compares the time at which it received the 
specific part of the code to the time at which the 
satellite was supposed to have sent it. This time 
delta directly corresponds to how far the 
receiver is from the given satellite. For a 
receiver to determine exactly where it is near 
the Barth, it must make at least three such 
measurements from three different satellites. 
For the receiver to accurately measure the time 
delta, it must have an extremely accurate 
internal clock. Most receivers do not have an 
atomic clock; therefore, a fourth measurement is 
taken from another satellite to help the receiver 


annunciated fault message occurs for the determine its clock bias and, thus, determine an 
applicable TACAN parameter. accurate state vector. 
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GPS Operation 


The NAVSTAR satellites transmit two separate 
codes, one intended for U.S. military use (called 
Y-code) and one for civilian use (called 
coarse/acquisition (C/A) code). The major 
difference between these two is that the military 
code is encrypted and requires the military 
receivers to have a special “key” to decipher the 
transmitted messages. The orbiter receivers 
contain the key necessary to use the encrypted 
Y-code; accuracy is expected to be better than 
110 ft. DoD is able to introduce noise into the 
civilian code to provide less accurate solutions 
to non-military users. This noise was removed 
from the civilian signal in 2000, but could be 
reinstated if the DoD determined it to be 
necessary. 


Starting with OV-105, the orbiter has three GPS 
receivers that operate redundantly. Each 
receiver is equipped with two antennas, one on 
the orbiter’s lower forward fuselage and one on 
the upper forward fuselage. The antennas are 
covered with thermal protection system tiles. 
The satellite signals are received by the 
antennas, amplified through a preamplifier, and 
then routed through a combiner to combine the 
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signals from the upper and lower antenna pairs 
into a single stream of data. From there, the 
signals are transmitted directly to the associated 
receiver for processing. The three convection- 
cooled GPS receivers are in the orbiter forward 
avionics bays. Each receiver is 6.78 inches high 
by 3.21 inches wide by 12.0 inches long; each 
weighs 13 pounds and consumes 40 watts of 
power. 


Unlike air data and MLS, where navigation data 
are used to update the onboard state vector, the 
selected GPS vector completely replaces the 
propagated vectors periodically during orbit 
(OPS 2 and 8) and entry (OPS 602/603 and OPS 
3). For example, during orbit, the FSW will 
replace its propagated state vector with a 
selected GPS vector every 90 minutes. This 
vector will then be propagated forward by the 
FSW for the next 90 minutes, using the nominal 
FSW propagation techniques. GPS information 
is displayed on the horizontal situation 
indicators (HSIs) on panels F6 and F8, as well as 
on the HORIZ SIT display (SPEC 50) and the 
GPS STATUS display (SPEC 55). 
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HORIZ SIT Display (SPEC 50) 
(Three-String GPS Vehicles) 
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GPS hardware controls are located at the top of 
panel O7. GPS 12,33 PRE AMPL UPPER 
(LOWER) switches provide power to each of the 
antenna preamplifiers, with circuit breakers 
located on panels O14, O15, and O16. Each 
receiver has a POWER switch on panel O7 and 
is powered through a single energy storage 
system (ESS) bus/forward power controller 
(FPC) combination. The ENCRYPT switches 
located on panel O7 control the integrity of the 
Y-code key within each receiver. In NORM, the 
key is kept intact such that it can be used to 
decode the Y-code signals being sent by the 
NAVSTAR satellites. If this switch is moved to 
the ZEROIZE position, the key will be erased 
from the memory of the receiver and the 
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measurements using the civilian codes. This is 
a procedure that would be used in the event of a 
non-U.S. landing to protect the key from being 
obtained by unauthorized users. A permanent 
switch guard prevents accidental movement of 
this switch. All of the new GPS switches on 
panel O7 will replace the existing TACAN 
switches. 
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GPS Controls 
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Unlike the classical redundancy management 
(RM) schemes applied to other shuttle sensors, 
the GPS uses a cyclic quality assessment (QA) 
process that is more conducive to its 
performance. Because of the nature of its 
operation, whereby poor satellite coverage may 
result in short periods of invalid data, it would 
not be prudent to "permanently" remove a unit 
from availability because of these questionable 
periods. 


There are four separate QA checks the software 
will perform to determine the status of the data 
from each receiver. These four checks include 
each receiver's estimate of the error in its own 
navigation state (ОАТ), the difference between 
each receiver's state and the FSW’s computed 
state (QA2), the difference between each 
receiver's current state and its previous state 
(ОАЗ), апа the differences between each 


receiver will only be able to make receiver and the other receivers (QA4). If the 
FSW determines that one of the QA1, QA3, or 
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QA4 checks has failed, the associated receiver 
will not be considered available to the selection 
filter. A miscompare of the QA2 check does not 
cause the receiver to be considered unavailable. 
With three candidates available (three level) to 
the selection filter, mid-value select (MVS) logic 
is used to select a unit’s state vector for 
processing. With two candidates available (two 
level), the candidate data are averaged. With 
only one receiver available (one level), the 
single GPS is selected. When no eligible GPS 
candidates are available, the GPS selection filter 
will propagate the last valid data for processing. 
This vector will not be used to update the 
onboard navigation state if it has been longer 
than 18 seconds since the selection filter has had 
valid GPS data. 


Air Data System 


The air data system provides information on the 
movement of the orbiter in the air mass (flight 
environment). There are two air data probes, 
one on the left and one on the right side of the 
orbiter's forward lower fuselage. During 
ascent, on orbit, deorbit, and initial entry 
phases, the probes are stowed inside the 
forward lower fuselage. The air data probe is 
covered by thermal protection system tiles 
while in the stowed position. At Mach 5, 
depending on mission requirements, the air 
data probes are deployed. Each probe is 4.87 
inches high, 21.25 inches long, 4.37 inches wide, 
and weighs 19.2 pounds. 


The air data system senses air pressures related 
to spacecraft movement through the 
atmosphere to update the navigation state 


vector in altitude, provide guidance in 
calculating steering and speed brake 
commands, update flight control law 


computations, and provide display data for the 
commander's and pilot's flight instruments, and 
various GNC displays. (The flight instruments 
are detailed in Section 2.7.) 


Each air data probe has four pressure-port sen- 
sors and two temperature sensors. The pres- 
sures sensed include static pressure and angle- 
of-attack upper, center, and lower pressure. 
The four pressures are sensed at ports on each 
probe. Тһе probe-sensed pressures аге 
connected by a set of pneumatic lines to two air 
data transducer assemblies (ADTAs). The two 
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temperature sensors are installed on each probe 
and wired to an ADTA. The pressures and 
temperatures sensed by the left probe are 
connected by pneumatic tubing to ADTAs 1 and 
3. Those sensed by the right probe are con- 
nected to ADTAs 2 and 4. 


OMS ENG T BFC CRT 
LEFT RIGHT DISPLAY SELECT 
ON 1+2 


AIR DATA 


PROBE STOW 
LEFT RIGHT 


ENABLE 


LIMIT SHUT ON 


ENABLE 
LEFT 


Ө 
LEFT 
(520) шин (512) 
INHIBIT 


INHIBIT. 
" & BC2| СА? 


FF2| БЕЗ 


ее 


ORBITAL DAP, 
CONTROL 
~ 


Р 


AUTO INRTL LVLH FREE 


=x = =x 
Gan (553141 [ETE] 


MODE — — — — —15 
TRANSLAT 10) тг ROTATION 
Y PITCH 


LOW Z 
нв Ё 


KXXX 
512304) 


NORM | 


BOOOQ 
(620100 


PULSE | PULSE 


ххх ххх EXXX 
(523019) 15240041 15153141 


(З5УТЗАЗА6) 


[———— AIR DATA PROBE — ——34 
© LEFT RIGHT 
DEPLOY/HEAT [———— FUEL CELL REACT VL 
i 3 


2 
CLOSE v 


AIR DATA PROBE Switches on Panel C3 


2.13-22 


Within each АРТА, the pressure signals are 
directed to four transducers, and the temp- 
erature signal is directed to a bridge. The 
pressure transducer analogs are converted to 
digital data by  digital-processor-controlled 
counters. The temperature signal is converted 
by an analog-to-digital converter. The digital 
processor corrects errors, linearizes the pressure 
data, and converts the temperature bridge data 
to temperatures in degrees Centigrade. These 
data are sent to the digital output device and 
then to the onboard computers to update the 
navigation state vector. The computers then 
send the data for display on various GNC 
displays and on the commander's and pilot's 
flight instruments. 


The ADTA SOP uses ADTA data to compute 
angle of attack, Mach number (M), equivalent 
airspeed (EAS), true airspeed (TAS), dynamic 
pressure (qbar), and barometric altitude (h). 


The GPCs compare the pressure readings from 
the four ADTAs. 1f all the pressure readings 
compare within a specified value, one set of 
readings from each probe is averaged and sent 
to the software. If one or more pressure signals 
of a set of probe pressure readings fail, the 
failed set's data flow is interrupted, and the 
software receives data from the other ADTA on 
that probe. If both probe sets fail, the software 
operates on data from the two ADTAs 
connected to the other probe. Тһе best total 
temperature from all four ADTAs is sent to the 
software. 


ports 
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Each probe is independently deployed by an 
actuator consisting of two ac motors connected 
to a rotary electromechanical actuator. Each 
probe is controlled by its AIR DATA PROBE 
switch on panel C3. To deploy the air data 
probes, the LEFT and RIGHT switches are 
positioned to DEPLOY. The redundant motors 
for each probe drive the probe to the deployed 
position. When the probe is fully deployed, 
limit switches remove electrical power from the 
motors. Deployment time is 15 seconds for two- 
motor operation and 30 seconds for single- 
motor operation. The DEPLOY position 
deploys the probe without electrical heaters; the 
DEPLOY/HEAT position deploys the air data 
probes with heaters powered. 


The AIR DATA PROBE STOW LEFT and 
RIGHT switches on panel C3 are used to stow 
the probes. The stow procedure includes 
positioning the switches to ENABLE and 
positioning the corresponding AIR DATA 
PROBE switch to STOW. The AIR DATA 
PROBE STOW INHIBIT position opens the ac 
motor circuits, disables the stow, and protects 
the microswitches. 


The fault detection system illuminates the red 
AIR DATA and BACKUP C/W ALARM lights 
on panel F7, and illuminates the MASTER 
ALARM. A fault also sounds the audible tone 
and generates a fault message. А com- 
munication fault illuminates the SM ALERT 
light. 
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Microwave Landing System 


The three onboard MLS units are airborne 
navigation and landing aids with decoding and 
computational capabilities. Тһе MLS units 
determine slant range, azimuth, and elevation 
to the ground stations alongside the landing 
runway. MLS is used during the approach and 
landing flight phases. When the channel 
(specific frequency) associated with the target 
runway approach is selected, the orbiter's 
MLS units receive elevation from the glide 
slope ground station and azimuth and slant 
range from the azimuth/distance-measuring 
equipment ground station. 


The orbiter is equipped with three independent 
MLS sets, each consisting of a Ku-band receiver 
transmitter and decoder. Data computation 
capabilities determine elevation angle, azimuth 
angle, and orbiter range with respect to the MLS 
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ground station. The MLS provides the orbiter 
highly accurate three-dimensional navigation 
position information to compute state vector 
components. The three orbiter Ku-band 
antennas are located on the upper forward 
fuselage. The three MLS апа decoder 
assemblies are located in the crew compartment 
middeck avionics bays. Each MLS decoder 
assembly is 8.25 inches high, 5 inches wide, 16.6 
inches long, and weighs 17.5 pounds. The radio 
frequency (RF) assembly is 7 inches high, 3.5 
inches wide, 10.25 inches long, and weighs 
6 pounds. 


The ground portion of the MLS consists of two 
shelters: an elevation shelter and an azi- 
muth/distance-measuring equipment (DME) 
shelter. The elevation shelter is located near the 
projected touchdown point, and the azi- 
muth/DME shelter is located at the far end of 
the runway. 
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The MLS ground station signals are acquired 
when the orbiter is close to the landing site, 
usually at an altitude of approximately 18,000 
feet. Final tracking occurs at the approach and 
landing interface at approximately 10,000 feet 
altitude and 8 n. mi. from the azimuth/DME 
station. (Refer to the Operations section for 
further information on entry procedures.) 


The MLS azimuth, elevation, and range data are 
used to compute steering commands from 
acquisition through landing and rollout. 


The commander's and pilot's horizontal situa- 
tion indicators display the orbiter's position 
with respect to the runway. Elevation with 
respect to planned glide slope is shown on the 
glide slope indicator. The course deviation 
needle displays azimuth information, and range 
is displayed on a mileage indicator. Azimuth/ 
DME data are used during the landing rollout. 


The three orbiter MLS sets operate on a 
common channel during the landing phase. 
The MLS ground station transmits a DME solicit 
pulse. The onboard MLS receiver responds 
with a DME interrogation pulse. The ground 
equipment responds by transmitting a return 
pulse. A decoder in the onboard MLS decodes 
the pulses to determine range, azimuth, and 
elevation. Range is a function of the elapsed 
time between interrogation pulse transmission 
and signal return. Azimuth pulses are returned 
in pairs. The spacing between the two pulses in 
a pair identifies the pair as azimuth and 
indicates on which side of the runway the 
orbiter is situated. Spacing between pulse pairs 
defines the angular position from the runway 
centerline. The spacing between the two pulses 
in a pair identifies the pair as elevation, while 
the spacing between pulse pairs defines the 
angular position of the orbiter above the 
runway. 


Each RF assembly routes range, azimuth, and 
elevation information in RF form to its decoder 
assembly, which processes the information and 
converts it to digital data for transmission to the 
onboard GNC software via the MDMs. 


Because the azimuth/DME shelters are at the 
far ends of the runway, the MLS provides 
useful data until the orbiter stops. Azimuth 
data provide position in relation to the runway 
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centerline; the DME gives the distance from the 
orbiter to the end of the runway. 


Each MLS has an MLS ON/OFF power switch 
and a CHANNEL (frequency) selection 
thumbwheel on panel O8. Positioning the MLS 
1, 2, or 3 switch to ON provides power to the 
corresponding system. MLS 1 receives power 
from main bus A, MLS 2 from main bus B, and 
MLS 3 from main bus C. Positioning the 
CHANNEL 1, 2, and 3 thumbwheels selects the 
frequency (channel) for the ground station at 
the selected runway for the corresponding MLS. 
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RADAR ALTIMETER Switches and MLS 
Switches and Thumbwheels on Panel O8 


Redundancy management selects range, 
azimuth and elevation angles for processing 
navigation data. The three MLS sets are 
compared to identify any significant differences 
among them. When data from all three MLS 
sets are valid, redundancy management selects 
middle values from three ranges, azimuths, and 
elevations. In the event that only two MLS sets 
are valid, the two ranges, azimuths, and 
elevations are averaged. If only one MLS set is 
valid, its range, azimuth, and elevation are 
passed for display. During fault detection, the 
SM ALERT light is illuminated, and a GPC 
annunciated fault message is shown. 
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Radar Altimeters 


The two RAs onboard the orbiter measure abso- 
lute altitude from the orbiter to the nearest 
terrain within the beam width of the orbiter's 
antennas. The two independent RAs consist of a 
transmitter and receiver antenna. The systems 
can operate simultaneously without affecting 
each other. The four C-band antennas are located 
on the lower forward fuselage. The two 
receiver/transmitters are located in the middeck 
forward avionics bays. Басһ radar altimeter 
receiver/transmitter measures 3.13 inches high, 
7.41 inches long, 3.83 inches wide, and weighs 
4.5 pounds. 


Each RA transmits a C-band (4,300 MHz 
modulated at 8.5 kHz) pulse through its 
transmitting antenna. The signal is reflected by 
the nearest terrain, and the leading edge of the 
return radar echo is locked on by the RA's 
receiving antenna. The altitude outputs by the 
RA are analog voltages, proportional to the 
elapsed time required for the ground pulse to 
return. The range output of the RA is from zero 
to 5,000 feet. The RA may not lock on if large 
pitch or roll angles are present. 


The GPCs process the data for display on the 
commander's and pilot's altitude tape and head 
up displays (described further in Section 2.7) 
from 5,000 feet. Two RADAR ALTIMETER 
ON/OFF switches are located on panel О8. КА 
data is not used as input to navigation; it is for 
crew use only. 


Flight Control System Hardware 


The flight control system (FCS) ascent and entry 
hardware provides manual guidance 
commands to GNC software and responds to 
effector commands from GNC software in order 
to effect vehicle and trajectory control. 


The following hardware includes 
responsible for flight control data: 


sensors 


• Accelerometer assembly (AA) -- senses 
vehicle accelerations along two body 
axes. 


e Rate gyro assembly (RGA) -- senses 
vehicle rotation rates about three body 
axes. 
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® SRB rate gyro assembly (SRB RGA) -- 
Senses vehicle rotation rates about two 
body axes during first stage ascent 
before SRB separation. 


The following hardware provides manual 
guidance commands: 
• Rotational hand controller (RHC) -- 


Commands rotational rates апа 
accelerations about a body axis. 


® Translational hand controller (THC) -- 
Commands vehicle translations along a 
body axis (orbit only). 


е Rudder pedal transducer assembly 
(RPTA) -- Generates an electrical output 
signal which is proportional to the 
rudder pedal displacement. During 
glided flight, this signal controls the 
position of the rudder. During rollout, 
this signal is used for nose wheel 
steering. 


e Speed brake/thrust controller (SBTC) -- 
During ascent, commands SSME throttle 
settings between 67% and 109% (PLT 
only). During entry commands the 
position of the speed brake (CDR & 
PLT). 


The following hardware responds to software 
commands: 


e Ascent thrust vector control (ATVC) -- 
Takes position commands generated by 
the GPCs during powered flight and 
converts them into position error 
commands, which are then used to drive 
the SSME and SRB nozzles. 


e Aerosurface servoamplifier (ASA) -- 
Takes position commands generated by 
the GPCs during glided flight and 
converts them into position error 
commands, which are then used to drive 
the aerosurfaces. 


Each piece of FCS hardware is hardwired to one 
of eight flight-critical MDMs connected to each 
of the five GPCs by data buses. Each GPC is 
assigned to command one or more data buses. 
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Flight Control Interfaces 


Accelerometer Assemblies 


There are four AAs onboard the orbiter, each 
containing two identical single-axis 
accelerometers. One senses vehicle acceleration 
along the lateral (left and right) vehicle Y axis; the 
other senses vehicle acceleration along the 
normal (vertical) Z axis. The four AAs are 
located in the crew compartment middeck 
forward avionics bays 1 and 2. The AAs are 
convection cooled. 


The AAs provide acceleration feedback to the 
FCS. These accelerations are used to augment 
stability during first-stage ascent, aborts, and 
entry, to relieve vehicle load during first-stage 
ascent, and to compute steering errors for 
display on the commander's and pilot's attitude 
director indicators. 


The lateral acceleration readings enable the FCS 
to null side forces during both ascent and entry. 
The normal acceleration readings augment 
pitch control and indicate the need to relieve 
normal loads. During the latter stages of entry, 
the normal acceleration measurements provide 
feedback for guidance to control pitch. (In 
contrast, the accelerometers within the IMUs 
measure three accelerations used in navigation 
to calculate state vector changes.) 


Each accelerometer consists of a pendulum 
suspended so that its base is in a permanent 
magnetic field between two torquer magnets. A 
light beam passes through an opening in one of 
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the torquer magnets; photodiodes are located 
on both sides of the other torquer magnet. 
When acceleration deflects the pendulum 
toward one photodiode, the resulting light 
imbalance on the two photodiodes causes a 
differential voltage. This voltage increases the 
magnetic field on one of the torquer magnets to 
rebalance the pendulum at an offset position 
representing the sensed acceleration. The 
magnitude of the current required to 
accomplish this 15 proportional to the 
acceleration. The polarity of the differential 
voltage depends on the direction of the 
pendulum's movement, which is opposite the 
direction of acceleration. The only difference 
between the lateral and normal accelerometers 
is the position in which they are mounted 
within the assembly. When the acceleration is 
removed, the pendulum returns to the null 
position. The maximum output for a lateral 
accelerometer is plus or minus 1 g; for a normal 
accelerometer, the maximum output is plus or 
minus 4 g's. 


The accelerations transmitted to the forward 
MDMs are voltages proportional to the sensed 
acceleration. These accelerations are sent to the 
GPCs, where ап accelerometer assembly 
subsystem operating program converts the 
eight accelerometer output voltages to 
gravitational units. This data is also sent to the 
MEDS displays and attitude director indicator 
during entry. 
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The accelerometer assemblies provide Ғай- 
operational redundancy during both ascent and 
entry. The four assemblies employ ап 
interchangeable mid-value software scheme 
(IMVS) to select the best data for redundancy 
management and a reasonableness limit check 
for failure detection. Software fault detection 
will operate when all four AAs are operational 
and will then detect the first failure and deselect 
that accelerometer assembly. А caution and 
warning message "RM FAIL ACC" is generated 
to inform the flight crew of an accelerometer 
failure. The RGA/ ACCEL caution and warning 
light on panel F7 is not supported. 
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Accelerometer 3 Power Control on Panel O16 


Accelerometer 1 is powered from main bus A 
through the ACCEL 1 circuit breaker on panel 
014. Accelerometer 2 is powered from main 
bus B through the ACCEL 2 circuit breaker on 
panel 015. Accelerometer 3 is redundantly 
powered through the ACCEL 3 ON/OFF switch 
on panel O16. Accelerometer 4 is redundantly 
powered through the ACCEL 4 ON/OFF switch 
on panel O15. The accelerometers are turned 
off once on orbit and on again before entry. 
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Orbiter Rate Gyro Assemblies 


The orbiter has four RGAs. Each RGA contains 
three identical single-degree-of-freedom rate 
gyros so that each gyro senses rotation about 
one of the vehicle axes. Thus, each RGA 
includes one gyro sensing roll rate (about the X 
axis), one gyro sensing pitch rate (about the Y 
axis), and one gyro sensing yaw rate (about the 
Z axis). These rates are the primary feedback to 
the FCS during ascent, entry, insertion, and 
deorbit. The FCS must have good rate feedback 
in all three axes to maintain control. 
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The RGAs are located on the aft bulkhead 
below the floor of the payload bay. They are 
mounted on cold plates for cooling by the Freon 
coolant loops. 


Each gyro has three axes. A motor forces the 
gyro to rotate about its spin axis. When the 
vehicle rotates about the gyro input axis, a 
torque results in a rotation about the output 
axis. An electrical voltage proportional to the 
angular deflection about the output axis, 
representing vehicle rate about the input axis, is 
generated and transmitted through the flight aft 
MDMs to the GPCs and RGA SOP. This same 
voltage is used within the RGA to generate a 
counteracting torque that prevents excessive 
gimbal movement about the output axis. The 
maximum output for roll rate gyros is +40° per 
second; for the pitch and yaw gyros, the 
maximum output is +20° per second. 


The RGA 1, 2, 3, and 4 power switches are 
located on panels O14, O15, O16, and O15 
respectively. The redundant power supplies for 
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RGAs 1 and 4 prevent the loss of more than one 
rate gyro assembly if main bus power is lost. 
The RGAs are turned off on orbit, except during 
flight control system checkout, to conserve 
power. RGAs are reactivated during deorbit 
prep, and prior to any transition to OPS 3, when 
they are required for the transition DAP to 
control vehicle attitude. 


WARNING 


A transition to OPS 3 with RGAs 
off can result in loss of control. 


The RGAs afford fail-operational redundancy 
during both ascent and entry. Redundancy 
management software employs an 
interchangeable mid-value scheme (IMVS) to 
select the best data for flight control use and has 
two methods of failure detection. A 
reasonableness limit fault detection operates 
when all four RGAs are operational and then 
detects the first failure and deselects that RGA. 
The RGAs also have power failure fault 
detection via a spin motor run detector (5МКЮ), 
which will deselect any RGA that has lost 
power up until only one RGA remains. A 
caution and warning message, "RM FAIL RGA," 
is generated to inform the flight crew of an RGA 
failure. 
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Solid Rocket Booster Rate Gyro Assemblies 


The SRB RGAs are used exclusively during 
first-stage ascent as feedback to find rate errors 
before SRB separation. There are two RGAs on 
each SRB, each containing two identical single- 
degree-of-freedom rate gyros. These gyros 
sense rates in the vehicle pitch and yaw axes 
similar in function to the orbiter RGAs. Because 
the SRBs are more rigid than the orbiter body, 
these rates are less vulnerable to errors created 
Бу structural bending. They аге thus 
particularly useful in thrust vector control. The 
two RGAs in each SRB are mounted on the 


2.13-31 


USA007587 
Rev. A 


forward ring within the forward skirt near the 
SRB-external tank attach point. 


Similar to orbiter RGAs, each SRB RGA generates 
an electrical voltage that is transmitted through 
the flight aft MDMs to the GPCs and the SRB 
RGA SOP. The SRB RGA SOP converts the eight 
voltages representing a rate into units of degrees 
per second. The maximum outputs for the SRB 
RGAs are 10° per second. These rates are used 
by the flight control system during first-stage 
ascent as feedback to identify rate errors, which 
are used for stability augmentation. The pitch 
and yaw axes and a combination of rate, attitude, 
and acceleration signals are blended to provide a 
common signal to the SSMEs and SRB thrust 
vector control during first stage. In the roll axis, 
rate and attitude are summed to provide a 
common signal to the engines and SRB thrust 
vector control. 


The compensated rate signals from the SRB RGA 
SOP are sent to redundancy management 
software, where the interchangeable mid-value 
scheme (IMVS) selects the best data for flight 
control use and a reasonableness limit check is 
performed for failure detection. The reasonable- 
ness limit fault detection will operate when all 
four SRB RGAs are operational and will then 
detect the first failure and deselect that rate gyro 
assembly. Unlike orbiter RGAs, SRB RGAs do 
not have fault detection for power failures. In 
addition, there is no crew insight into SRB RGA 
fault detection. 


The SRB RGAs are commanded to null and 
released from the flight control system 2 to 3 
seconds before SRB separation; SRB yaw and 
pitch rate data are then replaced with orbiter 
RGA pitch and yaw data. 


Rotational Hand Controller 


There are three RHCs on the orbiter flight deck: 
one at the commander's station, one at the 
pilot's station, and one at the aft flight deck 
station. Each RHC controls vehicle rotation 
about the roll, pitch, and yaw axes. During 
ascent, the commander's and pilot's RHCs may 
be used to gimbal the SSMEs and SRBs. For 
insertion and deorbit, the commander's and 
pilot's RHCs may be used to gimbal the OMS 
engines or to command the RCS jets. 
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On orbit, the commander's, pilot's, and aft flight 
station RHCs may be used to gimbal the OMS 
engines and command RCS jets. In addition, 
the commander's and pilot's RHCs may be used 
to command RCS jets during the early portion 
of entry, as well as to command the orbiter 
aerosurfaces during the latter portion of entry. 
The aft flight station RHC is used only on orbit. 


Human factors dictate that an RHC deflection 
produce a rotation in the same direction as the 
flight crewmember's line of sight. A SENSE 
switch on panel A6U selects the line-of-sight 
reference, either -Z or -X, for the aft station RHC. 


Several switches are located on the RHC. 
Depressing the red button on the right engages 
the backup flight system (BFS). The switch to 
the left trims the RHC by biasing the pitch and 
roll commands coming from the RHC. (The aft 
RHC's trim switch is inactive.) The trigger 
switch on each RHC is a push-to-talk switch 
that enables voice transmission. 


Each RHC contains nine transducers: three 
transducers sense pitch deflection, three sense 
roll deflection, and three sense yaw deflection. 
The transducers produce an electrical signal 
proportional to the deflection of the RHC. 
Each channel is powered by a separate power 
supply in its associated display driver unit. 
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Each controller is triply redundant; thus, only 
one good signal from a controller is required for 
the controller to operate. 


Each RHC has an initial dead band of 0.25° in 
all three axes. To move the RHC beyond the 
dead band, an additional force is required. 
When the amount of deflection reaches a certain 
level, called the soft stop, a step increase in the 
force required for further deflection occurs. The 
soft stop occurs at 19.5° in the roll and pitch 
axes, and 9.5° to 10.5° in the yaw axis. The 
mechanical hard stop is 24.3° in the roll and 
pitch axes and 14.3° in the yaw axis. 


Inputs from the RHCs to the FCS pass through a 
redundancy management scheme and the RHC 
SOP before they are passed to the aerojet digital 
autopilot. The RHC SOP performs four key 
functions. First, if an RHC is deemed bad, 
through redundancy management, then all 
commands from that RHC are set to zero. The 
SOP is also responsible for compensating and 
biasing the RHC commands, with the aft RHC 
commands transformed according to the SENSE 
switch position. Next the compensated and 
transformed commands are summed, by axis, to 
produce rotation commands for the flight 
control software. Finally, the SOP sets discretes 
to indicate if an RHC deflection is outside the 
software detent or beyond the software softstop. 


In a nominal mission, the flight crew can make 
manual inputs using the RHC during every 
major mode except terminal countdown. 
During all phases except ascent, when an RHC 
deflection exceeds the detent in an axis, the 
RHC SOP downmodes the flight control system 
from the automatic mode to control stick 
steering (CSS) in the axis of deflection. (This is 
referred to as “hot stick downmode".) During 
ascent, a CSS PITCH and/or ROLL/YAW 
pushbutton indicator on panel F2 or F4 must be 
depressed for manual inputs to be implemented 
into the flight control system from the 
commander's or pilot's КНС. Оп ascent, the 
CSS light for the pushbutton indicator 
illuminates, а CSS indicator appears on the 
Ascent/Entry Flight Display (AFD), and control 
is downmoded to CSS for all axes. On entry, 
the CSS light and the AFD CSS indicator appear 
for only the deflected axis that has downmoded. 
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When the flight crew commands three-axis 
motion using the RHC, the GPCs process the 
RHC and motion sensor commands. 


The FCS interprets the RHC motions (fore and 
aft, right and left, clockwise and counter- 
clockwise) as rate commands in pitch, roll, and 
yaw. The flight control equations are 
subsequently processed to provide control 
response and stability. If conflicting commands 
are given from more than one RHC, no 
commands result. 


CSS Pushbuttons on Panel F2 


During orbital flight, any one of the three sta- 
tions can input three-axis control commands to 
the flight control system. During entry and 
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landing, the commander and pilot have two- 
axis (bank and pitch only) capability. 
Aerosurface deflection trim, in all three axes, is 
controlled by the panel trim switches on panels 
L2 and C3, while bank and pitch vehicle rate 
trim is controlled with the trim switches on the 
RHC. For a return-to-launch-site abort, both the 
com-mander's and pilot's RHC have three-axis 
capability during powered flight and two-axis 
capability during gliding flight. 


The commander's RHC is powered when the 
FLT CNTLR POWER switch on panel F7 is 
positioned to ON. Similarly, the pilot's RHC 
and the aft RHC are powered when the FLT 
CNTLR POWER switches on panels F8 and 
A6U are positioned to ON. 
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RHC software redundancy management detects 
malfunctions in roll, pitch, or yaw axes for all 
three channels. The first malfunction detected 
will deselect all axes in that channel. For a 
second malfunction between the remaining two 
channels, the RHC is put in dilemma and the 
RHC SOP will no longer accept inputs from that 
RHC. For any detected malfunction, caution 
and warning generates an "RHC L," "RHC R," 
or "RHC A" message and illuminates the 
corresponding LEFT RHC or R/ AFT RHC light 
on panel Е7. 


Translational Hand Controller 


Signals from the THC in FCS command the RCS 
jets on orbit. There are two THCs, one at the 
commander's station and one at the aft flight 
deck station. The commander's THC is active 
during orbit insertion, on orbit, and during 
deorbit. The aft flight deck station THC is 
active only on orbit. 


Each THC contains six three-contact switches, 
one in the plus and minus directions for each 
axis (+X, -Х, +Y, -Y, +7, -Z). Moving the 
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forward THC to the right closes three switch 
contacts and commands translation along the 
plus Y axis. 


The aft THC is used when the crewmember is 
looking out the rear or overhead windows. The 
SENSE switch on panel A6U selects the line-of- 
sight reference along the -X or -Z axis of the 
orbiter for the aft THC. The SENSE switch must 
be in the -X position for aft windows and -Z for 
the overhead windows for the aft THC 
commands to be correctly transformed to give 
the desired orbiter movement. 


The THCs are used for manual control of 
translation along the longitudinal (X), lateral 
(Y), and vertical (Z) vehicle axes. 


The redundant signals from the forward and aft 
THC pass through a redundancy management 
process and SOP before being passed to the 
flight control system. If the forward and aft 
THCs generate conflicting translation com- 
mands, no output translation command 18 
issued. 


2.13-34 


2.13. GUIDANCE, NAVIGATION, AND CONTROL (GNC) 


USA007587 


Rev. A 
Ев y 
CDR1 === 
4) f ^ E 
an JO 
eh ва S Ааа Pea 
FLT CNTLR POWER Switch on Panel Еб 
Switch assemblies 
(triply redundant) 
Weight 5.6 pounds 
Cx X-axis 
Switch 
ҒЗ X-axis 
longitudinal 
Y-axis 2 
switch A) C Y-axis 
. lateral 
switch 
Z-axis 
vertical 
500 
Translational Hand Controller 
2.13-35 2. SYSTEMS 


2.13 Guidance, Navigation, and Control (GNC) 


USA007587 
Rev. A 


А! commands to the Forward line-of-sight Aft line-of-sight reference; Overhead line-of-sight 
flight control system Reference THC use Aft THC use Reference; Aft THC use 
are sent in this reference commander sense switch-X sense switch -Z 


Longitudinal Longitudinal Longitudinal 
THC movement 


Z 


|; 21 
9. ПХ ax - OT E LT. x 


Vertical i i Longitudinal 
THC movement 2 orbiter 
movement 


+Ү — 


Lateral Lateral 
THC movement orbiter 
movement 
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ATTITUDE. 
INRTL 22729 HIGH 
1111.cnv 
FLT CNTRL POWER and SENSE Switches 
on Panel A6U 
FLO88 138. Ш-і 
FLT CNTRL POWER Switches on Panel F8 
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THC software redundancy management detects 
miscompares between the three channels for all 
six directions of movement. The first miscom- 
pare detected deselects only that channel for 
that direction. A second miscompare between 
the remaining two channels puts that THC 
direction in dilemma, so its commands are no 
longer noted by flight control. For any detected 
miscompare, caution and warning generates an 
"SBTC/THC L" or "SBTC THC A" message. 


The commander's THC is powered when the 
FLT CNTLR POWER switch on panel F6 is 
positioned to ON. The aft THC is powered 
when the FLT CNTLR POWER switch on panel 
A6U is positioned to ON. 


Rudder Pedal Transducer Assembly 


There are two pairs of rudder pedals, one pair 
each for the commander and pilot. The 
commander's and pilot's rudder pedals are 
mechanically linked so that movement on one 
side moves the other side. When depressed, the 
pedal moves a mechanical input arm in an 
RPTA. The RPTA contains three transducers, 
each generating an electrical signal proportional 
to the rudder pedal deflection. 


Electronics 
(3 channels, 
3 boards) 
Intermediate 
cable assembly 


Connectors 
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The rudder pedals command orbiter accelera- 
tion in yaw by positioning the rudder during 
atmospheric flight. However, because the flight 
control software automatically performs turn 
coordination during banking maneuvers, the 
rudder pedals are not operationally used during 
glided flight. It is not until after touchdown 
that the crew uses them for nose wheel steering 
during rollout. 


The RPTA SOP maintains many functions in pro- 
cessing the RPTA data. The RPTA SOP converts 
the selected left and right commands from volts 
to degrees and selects the larger absolute value of 
the left and right commands for output to flight 
control software after applying a deadband. 
RPTA redundancy management software uses a 
reasonableness limit check to detect a 
malfunction among the three channels. When 
the first malfunction is detected, that channel will 
be deselected. A second malfunction between 
the remaining two channels puts the RPTA in 
dilemma and the RPTA SOP will set that RPTA 
output to zero. There is no crew insight into 
RPTA fault detection. 


Depressing the upper portion of the rudder 
pedals provides braking. Differential braking 
may also be used for directional control during 
rollout. 


Input shaft 
preloaded bearings, 
shaft seal and 
rotation stops 


504 


Rudder Pedal Transducer Assembly 
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Speed Brake/Thrust Controller 


There are two SBTCs, one on the commander's 
left-hand side on panel L2 and one on the pilot's 
left-hand side on panel C3. The SBTCs serve two 
distinct functions. During ascent, the pilot's 
SBTC may be used to throttle the engines. 
During entry, either the commander's or pilot's 
SBTC may be used to control aerodynamic drag 
(hence airspeed) by opening or closing the speed 
brake. 


At the forward setting, the SSME thrust level is 
the greatest, or the speed brake is closed. 
Rotating the SBTC back decreases the SSME 
thrust level or opens the speed brake. 


Each SBTC contains three transducers that 
produce а voltage proportional to the 
deflection. Redundancy management uses a 
mid-value select scheme (MVS) to determine 
output. It also uses a reasonableness limit check 
between the channels to detect failures. When 
the first malfunction is detected, that channel 
will be deselected. A second malfunction 
between the remaining two channels puts the 
SBTC in dilemma and inputs from that SBTC 
will no longer be accepted. For any detected 
malfunction, caution and warning generates an 
"SBTC/THC L" ог "SBTC/THC К" message. 


In the case of the engine thrust-level setting, the 
top half (AUTO) of both SPD BK/THROT 
pushbutton indicators on panels F2 and F4 are 
illuminated nominally. Only the pilot's SBTC 
can be enabled for manual throttle control. The 
pilot depresses the TAKEOVER pushbutton on 
the SBTC, causing the GPC throttle command to 
be frozen at its current value. While depressing 
the TAKEOVER button, the pilot moves the 
SBTC to match the frozen GPC command. 
Manual control is established when the SBTC 
command matches within four percent of the 
GPC command. When the match is achieved, the 
pilot's SPD BK/THROT MAN pushbutton 
indicator on panel F4 is illuminated, and the 
AUTO light is extinguished on both panels F2 
and Е4. A manual throttle indicator also appears 
on the Ascent/ Entry Flight Display (AFD). 
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Self- 
contained 
electronics 


Speed Brake/Thrust Controller 


At this point, the pilot will have manual control 
of the throttles and the TAKEOVER pushbutton 
is then released. If the TAKEOVER pushbutton 
is released before a match is achieved, the 
system reverts to GPC auto commands. Under 
manual throttle command, depressing either or 
both pushbutton indicators on panel F2 and F4 
causes the system to revert to the GPC auto 
commands. Transferring back to auto leaves 
the throttle at the last-commanded manual 
setting until a new command is issued. 


On entry, if the speed brake mode is in 
automatic, and the commander or pilot wishes 
to control the speed brake manually, 
momentarily depressing the TAKEOVER 
pushbutton takes manual control of the speed 
brake. The SPD BK/THROT MAN pushbutton 
indicator will be illuminated on the side with 
manual control and the AUTO lights will both 
be extinguished. А manual speed brake 
indictor also appears on the AFD. The speed 
brake is driven to the position currently 
commanded by the SBTC. To place the speed 
brake under software control, either or both 
SPD BK/THROT pushbutton indicators on 
panels F2 and F4 can be depressed, thus 
illuminating the AUTO lights on both panels. 
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The SBTC SOP converts the selected 55МЕ 
throttle command to a setting in percent and the 
selected speed brake command from volts to 
degrees. In addition, the SBTC SOP selects the 
speed brake command from the SBTC whose 
TAKEOVER button was depressed last. If both 
TAKEOVER buttons are depressed simultane- 
ously, the commander's SBTC is given control. 
If redundancy management declares an SBTC 
bad, the command is frozen. 


The commander's SBTC is powered by the FLT 
CNTLR POWER switch on panel F7 when 
positioned to ON. The pilot's SBTC is powered 
by the FLT CNTLR POWER switch on panel F8. 


Body Flap Switches 


There are two BODY FLAP switches, one on 
panel L2 for the commander and one on panel 
C3 for the pilot. Each switch is lever-locked and 
spring-loaded to the AUTO/OFF position. The 
UP and DOWN positions of each switch have 
two power supplies from separate control 
buses. In addition, each contact status is sent to 
the data processing system via an MDM. The 
switches provide manual control for positioning 
the body flap for main engine thermal 
protection and for pitch trim to reduce elevon 
deflections during the entry phase. 


Body flap control is initialized in its automatic 
with both BODY FLAP AUTO 


mode 
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pushbutton indicators illuminated on panels F2 
and Е4. The body flap can be switched to its 
manual mode by depressing either BODY FLAP 
pushbutton. The white BODY FLAP MAN 
pushbutton indicators will then illuminate, 
indicating manual control of the body flap. To 
regain automatic control, the BODY FLAP 
pushbutton indicator on panel F2 or F4 is again 
depressed, extinguishing the MAN light and 
illuminating the AUTO light. The pushbutton 
indicator is triply redundant. 


Panel Trim Switches 


Roll and pitch panel trim switches allow the 
crew to actually move the aerosurfaces, whereas 
the yaw panel trim switch inputs ап 
acceleration bias into the yaw channel. 


The TRIM PANEL switches on panel F3 enable 
control bus power to a set of three panel trim 
switches. The dual-redundant TRIM 
RHC/PANEL switches on panel F3 provide 
signals to the GPCs, prohibiting software 
execution of the associated RHC and panel trim 
switch inputs while in the INHIBIT position. 
The ENABLE position permits the RHC and 
TRIM PANEL switch to be used for trimming. 


Six panel switches control roll, pitch, and yaw. 
The switches, labeled ROLL TRIM, PITCH 
TRIM, and YAW TRIM, are located on panel L2 


AUTO || 
RZA) 


52. 

1 
AUTO | ROLL/ 
хх 


УАМ 


SPD ВК/ГНВОТ and BODY FLAP Pushbuttons on Panel Е4 
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for the commander and panel C3 for the pilot. 
The commander's trim switches on panel L2 are 
activated when the TRIM PANEL switch on the 
left side of panel F3 is positioned to ON. The 
pilot's trim switches on panel C3 are activated 
when the TRIM PANEL switch on the right side 
of panel ЕЗ is positioned to ON. Тһе 
corresponding TRIM RHC/PANEL switch must 
be in ENABLE for roll, pitch, and yaw trimming 
to take place. All the panel trim switches are 
spring loaded to the OFF position. 


RHC Trim Switches 


The RHC trim switches bias the rate commands 
coming from the RHC (up to 1.5 deg/sec in 
pitch; up to 2.5 deg/sec in roll). The RHC trim 
is active when the corresponding FLT CNTRL 
POWER switch on panel F7 or F8 is ON and the 
corresponding TRIM RHC/PANEL switch on 
F3 is in ENABLE. Like the panel trim switches, 
the RHC trim switches are spring loaded to the 
OFF position. 


Trim Switch RM 


Both the panel trim and the RHC trim switches 
have two contacts each. In the event of a 
dilemma as a result of disagreeing contacts, the 
resultant trim command in that axis is zero. 
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BODY FLAP and TRIM Switches on Panel C3 
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Aerosurface Servoamplifiers 


Vehicle control during atmospheric flight is 
accomplished in the entry phase by deflecting 
the seven aerosurfaces on the orbiter. Each 
aerosurface is driven by a hydraulic actuator 
controlled by a redundant set of electrically 
driven servovalves. There are four of these 
valves for each aerosurface actuator (except for 
the body flap, whose three actuators do not use 
servovalves and are instead hard-assigned to 
the three hydraulic systems). 


The servovalves are controlled by electronic 
devices called aerosurface servoamplifiers 
(ASAs). There are four ASAs located in ай 
avionics bays 4, 5, and 6. Each ASA commands 
one valve for each aerosurface. The ASA power 
switches are found on panels O14, O15, and O16. 


In addition to the command channels from the 
ASAs to the servovalves, there are data 
feedback channels to the ASAs from the 
aerosurface actuators. These feedback channels 
include position feedback signals and pressure 
feedback signals. Each aerosurface has four 
associated position feedback transducers that 
provide a servoloop closure for each of the four 
independent servoloops associated with the 
aerosurfaces. 


Left Inboard and 
Outboard Elevons 


Ihe path from an ASA to its associated 
servovalve in the actuators and the path back 
from the aerosurface feedback transducers to an 
ASA is called a flight control channel. There are 
four flight control channels for each 
aerosurface. 


Each of the four elevons located on the trailing 
edges has an associated servoactuator for 
positioning. Each servoactuator is supplied 
with hydraulic pressure from the three orbiter 
hydraulic systems. A switching valve is used to 
control the hydraulic system that becomes the 
source of hydraulic pressure for that 
servoactuator. Тһе valve allows a primary 
source of pressure to be supplied to that 
servoactuator. If the primary hydraulic 
pressure drops to around 1,200 to 1,500 psia, the 
switching valve allows the first standby 
hydraulic pressure to supply that servoactuator. 
If the first standby hydraulic pressure drops to 
around 1,200 to 1,500 psia, the secondary 
standby hydraulic source pressure is supplied 
to that servoactuator. The yellow HYD PRESS 
caution and warning light is illuminated on 
panel F7 if the hydraulic pressure of system 1, 2, 
or З is below 2,400 psia. The red BACKUP C/W 
ALARM light on panel F7 also illuminates. 


г- Rudder/Speed Brake - 2 Vertical Panels 

» Yaw control when both panels 
deflected left or right (rudder function) 

“ Aerodynamic drag contro! when panels 
opened (away from each other) or closed 
(toward each other) (speed brake function) 

• Rudder and speed brake commands 

are additive within limits 


Right Inboard and Outboard Elevons 
• Pitch control when deflected same 
direction as left elevons (elevator function) 
“ Roll control when deflected opposite 
direction of left elevons (aileron function) 
“ Inboard and outboard deflected 
identically during entry 
“ Pitch and roll commands аге 
additive within limits 


Body Flap 
» Main engine thermal protection 
* Pitch trim to reduce elevon deflections 511 


Aerodynamic Surfaces and Associated Control Axes 
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Interconnect wiring 
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Side cover 9 inches {to outside of covers) 


2 Printed wiring 
ж-е board assembly 
2“ 6.4 inches 


Fill port 9 Cushion 
5 - АС regulator 
: 27 
“ Conventional analog and DC/DC converter 
digital circuitry 
» Conventional printed circuit boards bs Ps Isolation valve driver 
* 28-volt dc power only 
* Environmentally sealed Сарїїме fastener (typical) 
* Cold-plate-cooled 512 
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4) с ©В25› (6826) (C527) (6829) (6830) servovalves that drive a modulating piston. 
ЫБА АВ ЕЙ Each piston is summed on а соттоп 
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ы = force-sum actuator. The summed force 
|О | (е) | © positions this power spool to control the flow of 
— 2 hydraulic fluid to the actuator power ram, also 
FF referred to as the primary actuator. The 
direction of ram movement is controlled, thus 
driving the elevon to the desired position. 
When the desired position is reached, the 
secondary power spool moves to block the 
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ASA 2 Power Switch on Panel O15 
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hydraulic pressure to the hydraulically 
operated ram, thus stopping the ram at that 
position. 


If a problem develops within a servovalve, or it is 
commanded to a position different than the 
positions of the other three within an actuator, 
secondary delta pressure (SEC AP), measured for 
that servovalve off the secondary force-sum 
actuator, begins to rise. Once the secondary delta 
pressure is at or above 2,025 psi for more than 
120 milliseconds, the corresponding ASA sends 
an isolation command to bypass that servovalve, 
effectively removing it from operation. 


The FCS CHANNEL yellow caution and 
warning light on panel F7 is illuminated to 
inform the flight crew of a bypassed servovalve. 
Also, an "FCS CH X" caution and warning 
message is generated, corresponding to which 
FCS channel (1, 2, 3, or 4) had a bypassed 
servovalve on one of its actuators. A red FCS 
SATURATION caution and warning light on 
panel F7 is illuminated if one of the four elevons 
is set at more than +12° or less than -15°. This 
condition also generates an "FCS SAT POS" 
caution and warning message, informing the 
crew that elevon movement is becoming 
saturated. The FCS SATURATION light is also 
illuminated if any one of the four elevons has a 
hinge moment greater than 80 percent and an 
"FCS SAT МОМ" message informs the crew that 
the elevon loading is saturated апа flight 
control is marginal. 


There are four FCS CHANNEL switches on 
panel C3. Each has an OVERRIDE, AUTO, and 
OFF position. The switch controls the channel's 
automatic isolation capability for high SEC AP 
for the elevons, rudder, speed brake, and SRB 
and SSME actuators. When an FCS CHANNEL 
switch is in AUTO, the isolation capability 
discussed above can take place. Moving the 
switch to OVERRIDE and back to AUTO will 
reset any isolated servovalves on that channel. 
Leaving the switch in OVERRIDE will prevent 
the auto isolation due to high SEC AP from 
taking place. When the switch is positioned to 
OFF, that channel is bypassed on all actuators. 


During ascent, the elevons are deflected to 
reduce wing loads caused by rapid acceleration 
through the lower atmosphere. In this scheme, 
the inboard and outboard elevons are deflected 
separately. By the time the vehicle reaches 
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approximately Mach 2.5, the elevons have 
reached a null position, where they remain. 
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FCS CHANNEL Switches on Panel C3 


The rudder/speed brake, which consists of upper 
and lower panels, is located on the trailing edge 
of the orbiter's vertical stabilizer. One 
servoactuator positions the panels together to act 
as a rudder; another opens the panels at the 
rudder's flared end so it functions as a speed 
brake. 


The rudder and speed brake servoactuators 
receive four command signals from the four 
ASAs. Each servoactuator is composed of four 
two-stage servovalves that function like those of 
the elevons to drive a secondary force-sum 
actuator or power spool. The exception is that 
the rudder's power spool controls the flow of 
hydraulic fluid to the rudder's three reversible 
hydraulic motors; the speed brake's power 
spool controls the flow of hydraulic fluid to the 
speed brake's three reversible hydraulic motors. 
Each rudder and speed brake hydraulic motor 
receives hydraulic pressure from only one of the 
orbiter's hydraulic systems as determined by 
switching valves like those of the elevons. 


The three rudder hydraulic motors provide 
output to the rudder differential gearbox, 
connected to a mixer gearbox that drives rotary 
shafts. These rotary shafts drive four rotary 
actuators, which position the rudder panels. 
The three speed brake hydraulic motors provide 
power output to the speed brake differential 
gearbox, connected to the same mixer gearbox 
as that of the rudder. This gearbox drives 
rotary shafts, which drive the same four rotary 
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actuators involved with the rudder. Within 
each of the four rotary actuators, planetary 


If a problem occurs in one of the four rudder or 
speed brake channels, the corresponding SEC 
AP transducer causes the corresponding ASA to 
open an isolation valve, bypassing that 
actuator's servovalve. The FCS CHANNEL 
switches control the rudder and speed brake 
channels the same way they control the elevons. 
If two of the three hydraulic motors fail in the 
rudder or speed brake, no servovalves are 
bypassed; however, about half the design speed 
output results from the corresponding gearbox. 


Three servoactuators at the lower aft end of the 
fuselage are used to position the body flap. 
Each is separately supplied with hydraulic 
pressure from one of the three orbiter hydraulic 
system and has a solenoid-operated enable 
valve controlled by one of three ASAs. Note 
that the fourth ASA is not used for the body 
flap command, but it is still used for position 
feedback. Each solenoid-operated enable valve 
supplies hydraulic pressure from one orbiter 
hydraulic system to two corresponding 
solenoid-operated up and down pilot valves, 
which are, in turn, controlled by one of the three 
ASAs. 


When one of the individual pilot valves receives 
а command signal from its corresponding ASA, 
it positions a common mechanical shaft in the 
control valve, allowing hydraulic pressure to be 
supplied to the hydraulic motors. The 
hydraulic motors are reversible, allowing the 
body flap to be positioned up or down. The 
hydraulic brake associated with each hydraulic 
motor releases the hydraulic motor for rotation. 
When the desired body flap position is reached, 
the control valves block the hydraulic pressure 
to the hydraulic motor and apply the hydraulic 
brake. Each hydraulic motor provides the 
power output to a differential gearbox, thus 
driving a rotary shaft and four rotary actuators, 
which position the body flap. Four rotary 
position transducers measure the output of the 
differential gearbox to provide position 
feedback through all four ASAs to the flight 
control system software. 


There is no channel isolation capability for the 
body flap. With the FCS CHANNEL switch in 
OFF, the corresponding ASA's body flap 
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gears blend the rudder positioning with the 
opening of the speed brake. 


commands are removed from the solenoid 
valves. If the hydraulic system associated with 
the hydraulic motor fails, the remaining two 
hydraulic motors position the body flap, and 
the HYD PRESS caution and warning light is 
illuminated. 


Each ASA is hardwired to a flight aft MDM. 
Commands originate from guidance software or 
from controllers. These inputs go to the flight 
control software, where they are routed to the 
ASAs. Several SOP functions associated with 
the ASA commands and data include: 


e Converts elevon, rudder, and speed brake 
commands produced by flight control 
software from degrees to millivolts 


e Sets commands to body flap valves 
based on an enable command from body 
flap redundancy management and 
up/down commands from flight control 


® Converts position feedback to degrees 
for the elevons, rudder, speed brake, 
and body flap 


® Computes body Нар and speed brake 
deflections as percentages 


• Calculates elevon and rudder positions 
for display on the surface position 
indicator 


e Monitors the FCS CHANNEL switches 
and, if any аге positioned to 
OVERRIDE, sets the override command 
for that ASA 


* Monitors hydraulic system pressures for 
failures and limits aileron and elevator 
commands according to the number of 
failures 


Isolation status of the FCS CHANNEL 
servovalves is displayed on the GNC SYS 
SUMM 1 display under FCS CH for all 
actuators, and on the SPEC 53 CONTROLS 
display in more detail for each aerosurface and 
SSME actuator. 
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SSME Thrust Vector Control Interface Flow 


The associated flight aft MDMs are also located 
in the aft avionics bays. 


ATCV - Ascent thrust vector control MPS - Main propulsion system 

FCS - Flight control system RHC - Rotational hand controller 

GPCs - General-purpose computers SOP - Subsystem operating program 

MDM - Multiplexer/demultiplexer ТУС - Thrust vector control 
Ascent Thrust Vector Control 

Weight: 39.9 Ibs | 


Ascent Thrust Vector Controller 


The orbiter ATVC portion of the FCS controls 
attitude and trajectory directing the thrust of the 
three main engines and two solid rocket 
boosters during lift-off and first-stage ascent, 
and of the main engines only during second- 
stage ascent. 


ATVC is provided by four avionics hardware 
packages that supply gimbal commands and 
fault detection for each hydraulic gimbal 
actuator. The packages are located in the three 
aft avionics bays in the orbiter aft fuselage and 
are cooled by cold plates and the Freon system. 
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The ATVC command flow starts in the GPCs, in 
which the flight control system generates the 
position commands, and terminates at the 
SSME and SRB servoactuators, where the 
actuators gimbal the nozzles in response to the 
commands. All the position commands are 
issued to the ATVC command SOP. This 
program processes апа transmits the 
commands to their corresponding flight aft 
MDMs. The commands are then separated and 
distributed to the four ATVC channels, which 
generate equivalent command analog voltages 
for each command issued. These voltages are, 
in turn, sent to one of four servovalves on a 
servoactuator, commanding the SSME and SRB 
hydraulic actuators to extend or retract, thus 
gimbaling the nozzles to which they are 
fastened. 


Ten actuators respond to the command voltages 
issued by four ascent thrust vector control 
channels. Each FCS channel contains an ATVC 
that has six SSME drivers and four SRB drivers. 
Each actuator receives four identical command 
voltages from four different drivers, each 
located in one of the four ATVCs. 


Both main engine and solid rocket booster 
servoactuators consist of four independent, 
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two-stage servovalves that receive signals from 
the drivers. The force of these four servovalves 
is summed on a secondary force-sum actuator 
or power spool, which positions an actuator 
ram and thus the engine to control thrust 
direction. 


The four servovalves in each actuator provide a 
force-summed majority voting arrangement to 
position the power spool. With four identical 
commands to the four servovalves, the 
actuator's force-sum action prevents a single 
erroneous command from affecting power ram 
motion. If the erroneous command persists for 
more than a predetermined time, differential 
pressure measured off of the secondary force- 
sum actuator for that servovalve is sensed in the 
corresponding ATVC, which activates an 
isolation driver. This driver energizes an 
isolation valve that isolates the defective 
servovalve and removes hydraulic pressure, 
permitting the remaining channels and 
servovalves to control the actuator ram spool, 
provided the FCS CHANNEL 1, 2, 3, or 4 switch 
on panel C3 is in the AUTO position. A second 
failure would isolate the defective servovalve 
and remove hydraulic pressure in the same 
manner as the first failure, leaving only two 
channels remaining. 


Failure monitors are provided for each channel 
on the GNC SYS SUMM 1 display and with the 
yellow FCS CHANNEL and red BACKUP C/W 
ALARM lights on panel F7 to indicate which 
channel has a bypassed servovalve for any of 
the MPS and/or solid rocket boosters. There is 
more detailed crew information on precisely 
which MPS actuator has a bypassed servovalve 
on the SPEC 53 CONTROLS display. If the FCS 
CHANNEL 1, 2, 3, or 4 switch on panel C3 is 
positioned to OFF, then that ATVC channel is 
isolated from its servovalves on all SSME and 
solid rocket booster actuators. The OVERRIDE 
position of the switch inhibits the 
corresponding ATVC from automatically 
bypassing servovalves on that channel due to 
high secondary delta pressure problems on the 
power spool and provides the capability to reset 
a bypassed servovalve on that channel. 
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The ATVC 1, 2, 3, 4 power switches are located 
on panel O17. The ON position enables the 
ATVC channel selected; OFF disables the 
channel. 


OFF 


АТУС Power Switches on Panel O17 


The SSME servoactuators change each main 
engine's thrust vector direction as needed 
during the flight sequence. Each main engine 
has one pitch actuator and one yaw actuator. 
The pitch actuator gimbals the engine up or 
down a maximum of 10.5° from the installed 
null position. The yaw actuator gimbals the 
engine left or right a maximum of 8.5° from the 
installed position. The installed null position 
for the left and right main engines is 10° up 
from the X axis and 3.5° outboard from an 
engine centerline parallel to the X axis. The 
center engine's installed null position is 16° 
above the X axis centerline for pitch and on the 
X axis centerline for yaw. When any engine is 
installed in the null position, the other engines 
cannot collide with it. 


Each SRB also has two thrust vector control 
actuators. However, the SRB TVC coordinate 
axes are called "rock" and "tilt" rather than pitch 
and yaw. The rock and tilt axes form a 45° 
angle with the pitch and yaw axes. This allows 
an equivalent +7° movement range in pitch and 
yaw with a rock/tilt gimbal range of +5°. 
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SSME and SRB Thrust Vector Control 


Digital Autopilot 


The digital autopilot (DAP) is the heart of 
flight control software. It is composed of 
several software modules that interpret 
maneuver requests, compare them to what 
the vehicle is doing, and generate commands 
for the appropriate effectors. There are 
different DAPs for different flight phases, 
particularly insertion and orbit, and various 
modes and submodes within each. 


The DAP controls the orbiter in response to 
automatic or manual commands during 
insertion and on orbit. The effectors used to 
produce control forces and moments on the 
orbiter are the two OMS engines and the 38 
primary RCS jets. Six vernier RCS jets are 
also available on orbit for attitude control. 
The forward and aft RCS jets also provide 
attitude control and three-axis translation 
during external tank separation, insertion, 
and on-orbit maneuvers, as well as roll 
control for a single-OMS-engine operation. 


2. SYSTEMS 


The OMS provides propulsive control for 
orbit insertion, orbit circularization, orbit 
transfer, and rendezvous. 


Orbital DAP Panel 


There are 24 ORBITAL DAP pushbutton 
indicators on panels C3 and A6U. Assuming 
no electrical, computer, or hardware failures 
affect the operation of the indicators, inputs 
made to one panel are reflected in the 
configuration of the other panel. АП the 
pushbuttons are active in the Orbital DAP, 
whereas only a subset are operational in the 
Transition DAP or when the backup flight 
system is engaged. None of the indicators are 
operational during ascent or entry. As with 
other aft flight-deck controls, aft panel A6U 
pushbutton indicators (PBIs) are only 
supported in OPS 2. 


A discussion of the various pushbuttons 
follows: 
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DAP CONFIG Display (SPEC 20) 


The SELECT (A or B) PBIs toggle the Orbital 
DAP between one of two configurations. These 
configurations are changed and displayed on 
the DAP CONFIG display (SPEC 20). 


The CONTROL РВІѕ toggle the Orbital DAP 
between AUTO, INRTL, LVLH, and FREE. In 
AUTO the orbiter's attitude is controlled by 
universal pointing (UNIV PTG) or orbit burn 
guidance. In this control mode, the Orbital 
DAP will rotate the orbiter about the shortest 
angle to the desired attitude. The rate of 
rotation is determined by ROT RATE items on 
the DAP CONFIG (SPEC 20) display. Once in 
attitude, the Orbital DAP will fire jets to 


maintain the attitude and attitude rates within 
the deadbands specified on the DAP CONFIG 
display. 


In CONTROL INRTL, the orbiter is in inertial 
attitude hold (a fixed orbiter attitude relative to 
an inertial reference), and in CONTROL LVLH 
the orbiter is in LVLH hold (a fixed orbiter 
attitude relative to the Earth). The ROTATION 
DISC RATE pushbutton indicators must be 
illuminated for INRTL or LVLH to hold 
attitude. 


The CONTROL FREE PBI puts the Orbital DAP 
into free drift. In this mode, the ROTATION 
PULSE pushbutton indicators will illuminate, 
and RCS jets will not fire if the RHC and THC 
remain in detent. 


The first row of the MANUAL MODE 
TRANSLATION pushbuttons control which of 
the *Z (up firing) jets will fire. Nominally, none 
of the pushbutton indicators are illuminated, 
and the "normal" number of up firing jets will 
be commanded to fire If the LOW 2 
pushbutton indicator is depressed, Orbital DAP 
will never command an up firing jet to fire. 
Тыз mode is used to protect a payload or 
crewmember that is operating close to the 
orbiter. 


In HIGH 7, all the up firing jets will be 
commanded to fire if a +7. translation is 
commanded with the THC. All other Orbital 
DAP maneuvers will result in the "normal" 
number of up firing jets to fire. This mode is 
used to quickly separate the orbiter from a 
payload. 


The second and third rows of MANUAL MODE 
TRANSLATION pushbuttons toggle the Orbtial 
DAP between NORM and PULSE. In NORM, 
RCS jets will be continuously commanded to 
fire if the THC is moved out of detent. In 
PULSE, Orbital DAP will fire RCS jets to 
achieve the TRANSLATION PULSE гаје 
specified on the DAP CONFIG display. The 
PULSE units are feet per second. 


The first row of the MANUAL MODE 
ROTATION portion of the DAP panel toggles 
the Orbital DAP between primary (PRI), 
alternate (ALT), and vernier (VERN). In PRI, 
one or more of the primary RCS jets will be 
continuously commanded to fire if either the 
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attitude or attitude rate deadbands are 
exceeded. This mode will not be used for many 
different RMS and payload operations. 


In ALT, the primary RCS jets are still used, but 
the number of jets, duration of firings, and time 
between firings can be controlled on the DAP 
CONFIG display. This extra control of jet 
firings greatly reduces the stress on a payload 
and the RMS. The ALT mode allows almost 
unrestricted payload and RMS operations if the 
vernier jets are not available. In ALT mode, the 
Orbital DAP also determines the best jet(s) to 
fire based on the combined orbiter/ payload 
moments of inertias. These inertias are selected 
with CNTL ACCEL (item 14) on the DAP 
CONFIG display. 


In VERN, the Orbital DAP uses the six vernier 
RCS jets for attitude control. Vernier control 
produces less stress on the RMS/payload, uses 
less propellant, and сап achieve tighter 
deadbands than either PRI or ALT. Like the 
ALT mode, the best jet(s) to use are determined 
by the orbiter/ payload moments of inertias. 


The second and third rows of the ROTATION 
pushbutton indicators toggle the Orbital DAP 
between discrete rate (DISC RATE) and PULSE. 
For these rows to have any effect, the ORBITAL 
DAP CONTROL must not be in AUTO. In 
DISC RATE, if the RHC is taken out of detent, 
the Orbital DAP will fire RCS jets to achieve 
and maintain the rate specified by the ROT 
RATE in the DAP CONFIG display. If the RHC 
is in detent, the Orbital DAP will fire jets to 
maintain either INRTL or LVLH attitude hold, 
depending on the selection of the ORBITAL 
DAP CONTROL pushbutton indicators. 


In ROTATION PULSE, moving the RHC out of 
detent commands a pulse of jet firings to 
increase the rotation rate by the ROT PLS rate 
specified on the DAP CONFIG display. When 
the RHC is in detent, the Orbital DAP is in free 
drift for that axis. Pushing the CONTROL 
FREE pushbutton indicator is functionally 
equivalent to pushing all three ROTATION 
PULSE pushbutton indicators. 


Continuous rotation RCS jet firings can be 
obtained by moving the RHC past the soft stop. 
This continuous firing of jets can be obtained in 
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either DISC RATE or PULSE. Even if 
CONTROL is in AUTO, moving the RHC out of 
detent will force the Orbital DAP to INRTL, and 
further movement past the soft stop will cause 
continuous jet firings. 


Transition DAP 


The Transition DAP is used from MECO until 
transition to OPS 2, and then again in MM 301- 
303. 


At MECO, the Transition DAP first becomes 
active, firing RCS as needed to null out any 
residual rates. External tank separation is 
automatically commanded about 20 seconds 
after MECO. Here, the Transition DAP sends 
commands to fire the orbiter's down firing RCS 
jets, causing the orbiter to translate in the -Z 
direction. When a rate of 4 feet per second is 
reached, RCS commands are removed. 


Insertion flight control is also accomplished 
with the Transition DAP. The Transition DAP 
uses commands from the guidance software for 
automatic maneuvers to the OMS burn attitude 
using RCS jets. During the OMS-2 burn (and 
OMS-1 burn, if required), the Transition DAP 
uses the OMS engines thrust vector control and 
RCS jets, as needed. The Transition DAP also 
receives commands from the commander's THC 
and the commander's or pilots RHC. Тһе 
Transition DAP then takes these commands and 
converts them into appropriate RCS or OMS 
TVC commands. The Transition DAP monitors 
the resultant attitude and attitude rates and 
sends the necessary commands to 
achieve the desired attitude and attitude rate 
within premission-specified deadbands. 


The flight crew interfaces directly with the 
Transition DAP through the forward RHCs and 
THC and indirectly through entries to the OMS 
MNVR EXEC display and the ORBITAL DAP 
pushbuttons on panel C3. 


In the Transition DAP, the commander's THC is 
active and totally independent of the DAP 
pushbuttons or RHC position or status. 
Whenever the commander's THC is out of 
detent in either plus or minus X, Y, or Z, 
translation acceleration commands аге sent 
directly to the RCS jet selection logic for 
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continuous RCS jet firing. Rotational 
commands may be sent simultaneously with 
translation commands within the limits of the 
RCS jet selection logic. For example, if both 
plus X and minus Z translations аге 
commanded simultaneously, plus X translation 
receives priority. 


For rotations, the flight crew can select either 
automatic or manual control via the ORBITAL 
DAP CONTROL pushbutton indicators (AUTO, 
INRTL) or manual control by moving the RHC 
out of detent. In INRTL, the capability exists to 
rotate about any axis in one of two modes. 
When the ROTATION PULSE mode is selected, 
each RHC deflection results in a single burst of 
jet fire. In DISC RATE mode, RHC deflection 
results in a specified rate being commanded in 
that axis for the entire time the RHC is 
deflected. A free-drift mode (INRTL/ PULSE) is 
also available in which no RCS jets are fired, or 
an attitude-hold mode, in which the Transition 
DAP sends commands to maintain the current 
attitude with null rates within premission- 
specified deadbands. Also, if the RHC is 
deflected beyond the soft stop, continuous RCS 
jet firings result. In translation, movement of 
the THC results in continuous jet firings. Pulse 
translation mode is not available in the 
Transition DAP. 


The Transition DAP also involves maintaining 
the OMS thrust vector control. Тһе OMS 
processor generates OMS engine gimbal 
actuator thrust vector control commands to 
produce the desired | spacecraft/engine 
relationship for the specified thrust direction. 


For the OMS burn, the orbital state vector 
(position and velocity) is produced by 
navigation using inertial measurement unit 
delta velocities during powered and coasting 
flight. This state is sent to guidance, which uses 
target inputs through the IDP to compute thrust 
direction commands for flight control and burn 
parameters for DPS display. Flight control 
converts the commands into OMS engine 
gimbal angles (thrust vector control) for the 
OMS burn. 


OMS thrust vector control for a normal two- 
engine burn is entered by depressing the 
ORBITAL DAP CONTROL AUTO pushbutton 
indicator with both RHCs within software 


2.13-51 


USA007587 
Rev. A 


detents. OMS manual thrust vector control for 
both OMS engines is entered by depressing the 
INRTL pushbutton indicator or by moving the 
commander's or pilot's RHC out of detent. The 
flight crew supplies the rate commands to the 
burn vector control system instead of guidance. 
The manual RHC rotation requests аге 
proportional to RHC deflections and are 
converted into gimbal angles. OMS thrust in 
either case is applied through the spacecraft's 
center of gravity. 


Orbital DAP 


The orbital flight control software includes an 
RCS DAP, an OMS TVC DAP, and an attitude 
processor module to calculate vehicle attitude, 
as well as logic to govern the selection of a 
DAP. The attitudes calculated by the attitude 
processor are displayed on the attitude director 
indicator, as well as on the OPS 201 UNIV PTG 
display, which is available whenever orbit 
software is active. The vehicle attitude is used 
by the DAP to determine attitude and rate 
errors. 


RCS DAP 


The RCS DAP is used at all times in the on-orbit 
phase except during an OMS burn. This DAP 
controls vehicle attitudes and rates through RCS 
jet fire commands. Either the larger primary 
jets or the less powerful vernier jets can be used 
for rotational maneuvers, depending on 
whether PRI, ALT, or VERN is selected on the 
panel C3 (or A6U) ORBITAL DAP CONTROL 
panel. The choice of primary or vernier 
thrusters depends оп fuel consumption 
considerations, how quickly the vehicle needs 
to be maneuvered to satisfy a mission objective, 
and interaction with payloads. ALT mode uses 
primary jets with fewer jet firings of a small 
duration and selectable delay between firings to 
allow attitude control when  vernier jet 
capability is lost. 


The rotation rates and deadbands, translation 
rate, and additional DAP options can be 
changed by the flight crew during the orbit 
phase using the DAP CONFIG display. The 
flight crew loads the DAP with these options in 
two ways, one option set is accessed by 
depressing the A pushbutton on the ORBITAL 


2. SYSTEMS 
2.13 Guidance, Navigation, and Control (GNC) 


USA007587 
Rev. A 


DAP SELECT panel and the other by depressing 
the B pushbutton. 


Each planned DAP configuration is given a ref- 
erence number. In general, the A configurations 
have larger deadbands апа slower 
maneuvering rates than the B configurations. 
The wider deadbands of the A configurations 
are used to minimize fuel usage, while the 
tighter deadbands of the B configurations allow 
greater precision in executing maneuvers or 
holding attitude. 


The RCS DAP operates in either AUTO or in 
one of two manual modes (INRTL or ІУІН), 
depending on selections made on the ORBITAL 
DAP CONTROL panel. The INRTL mode is 
also accessed when the RHC is moved out of its 
detent position (i.e., “hot stick downmode"). In 
both the automatic and manual modes, the 
rotation rate is controlled by the selection of 
DAP A or B and the information loaded in the 
DAP CONFIG display. Іп addition, in 
automatic, the DAP determines the required 
attitude to be achieved from the UNIV PTG 
display and then computes the RCS jet-fire 


commands necessary to achieve these 
requirements within the current set of 
deadbands. 


In the manual rotation mode, the RCS DAP 
converts flight crew inputs from any of the 
three RHCs to RCS jet-fire commands, 
depending on whether PULSE or DISC RATE is 
selected on the MANUAL MODE ROTATION 
ROLL, PITCH, and YAW pushbuttons on panel 
СЗ or Аб. Simply, when PULSE is selected, a 
single burst of jet fire is produced with each 
RHC deflection. The desired rotational rate is 
specified on the DAP CONFIG display 
(ROTATION). When DISC RATE is selected, jet 
firings occur whenever the RHC is out of 
detent, but inside the soft stop, thus 
maintaining the rotational rate specified on the 
DAP CONFIG display. When the RHC is 
beyond the soft stop, continuous jet firings will 
result. When the RHC is returned to detent, the 
current M50 attitude will be maintained within 
the specified deadbands. 


Another manual RCS DAP mode, local 
vertical/local horizontal (LVLH), is used to 
maintain the current attitude with respect to the 
rotating LVLH reference frame. It is selected 
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through the LVLH pushbutton on panel C3 or 
А60. 


The RCS DAP includes only a manual transla- 
tion capability, executed through the forward or 
aft THC. Only the primary RCS jets are used. If 
in VERN, DAP will automatically upmode to 
primary RCS (PRCS) when the THC is moved 
out of detent. The DAP will return to VERN or 
ALT when the desired rate is achieved or the 
THC is returned to detent. Deflections of the 
THC result in RCS jet firings based on the 
MANUAL MODE TRANSLATION pushbutton 
indicator selected on the ORBITAL DAP panel. 
PULSE mode results in a single burst of jet fire. 
NORM mode results in continuous jet firings as 
long as the THC is out of detent. 


Two additional submodes, HIGH Z and LOW 
Z, are available for special applications of +Z 
translations. NORM will fire three up-firing jets 
when a +7. translation is commanded and is the 
default. HIGH Z will fire all nine up-firing jets 
and would be used only for emergency escape 
from the vicinity of another orbiting body. 
LOW Z fires two aft-firing and two forward- 
firing jets for +Z maneuvers. LOW Z is used to 
maneuver near payloads that can be contami- 
nated or damaged by the plume from an up- 
firing jet. Selection of NORM, HIGH Z, or LOW 
7 has no effect on choice of jets for XX, XY, or -Z 
translations. LOW Z will inhibit upfiring jets 
for rotations. 


OMS TVC DAP 


The OMS thrust vector control DAP is available 
when an OMS burn is executed through the 
ORBIT MNVR EXEC display. The TVC DAP 
uses the guidance-generated velocity require- 
ments and converts these into the appropriate 
OMS gimbal commands, assuming AUTO is 
selected on the ORBITAL DAP CONTROL 
panel. The TVC DAP also generates the OMS 
fire commands, the OMS shutdown commands, 
and, if necessary, due to OMS engine failure, 
the required КС5 commands to maintain 
attitude control. Under INRTL selection, the 
TVC DAP takes inputs from the RHC to control 
attitude during the burn. When the RHC is in 
detent, the TVC DAP will maintain the current 
inertial attitude. 
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Before OMS ignition, the orbiter is 
automatically or manually maneuvered to the 
OMS ignition attitude using the RCS jets. 
Automatic TVC for one OMS engine is identical 
for two, except that the RCS processor is 
responsible for roll control. Single-OMS-engine 
burn is also through the orbiter's center of 
gravity, except when pitch or yaw гаје 
commands are non-zero. If the left or right 
OMS engine fails during a burn, a red LEFT or 
RIGHT OMS light on panel F7 is illuminated. 
Since an OMS cutoff is based on time rather 
than velocity, a velocity residual may exist 
following the cutoff. The residual can be 
reduced to zero by the RCS through the THC. 


Aerojet DAP 


Entry flight control is accomplished using the 
Aerojet DAP, which generates effector and RCS 
jet commands to control and stabilize the 
vehicle during its descent from orbit. During 
exoatmospheric flight, or flight during which 
certain aerosurfaces are rendered inefficient due 
to adverse aerodynamics, a combination of 
aerosurface and RCS jet commands are used. 


The Aerojet DAP has the following characteris- 
tics: 


(1) Flight adaptive (changes as a function 
of qbar) 


(2) Closed loop (compares feedback with 
command to generate an error signal) 


(3) Rate command (jets and aerosurfaces 
are commanded as necessary to achieve 
the desired rate) 


Once the desired rate is obtained, forward loop 
trim integrators maintain the desired rate. The 
Aerojet DAP is activated by MM 304 transition, 
usually at EI-5, and runs through wheel stop on 
the runway. It slowly blends out the use of jets 
and blends in the use of aerosurfaces as the 
orbiter makes the transition from a spacecraft to 
hypersonic glider to subsonic glider to finally a 
high-speed 100-ton tricycle. 


Pitch control is driven by either the auto system 
via alpha error (MM 304/602) or Nz error (MM 
305/603), which is turned into a rate command, 
or by CSS via RHC input. This rate command is 
compared to the pitch RGA output to come up 
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with a rate error that is turned into a jet 
command until qbar = 40 psf, and/or elevator 
command after qbar = 2 psf. The body flap is 
used as a trim device to keep the elevons on or 
near schedule. This allows the elevons to be in 
the right position for maximum effectiveness, 
and to limit hinge moments and thermal effects. 
The speed brake is opened at Увш, = 10,000 fps 
and is used supersonic as a lateral-directional 
stability device (speed brake opens causing a 
pitch-up moment that the elevons counteract by 
moving down, making the elevons more 
effective as an elevator and as ailerons). 
Subsonic, the speed brake is used first as an 
energy modulator, then as a qbar modulator 
below 9,000 ft. 


Other features of the pitch channel include: 


® Pitch panel trim moves the elevons up 
or down. It requires trim be enabled 
and on, and either the CDR or PLT use 
the TRIM switches on panel L2 or C3. 
There is no current use for this feature, 
especially with the body flap in AUTO. 


е RHC pitch rate trim biases the output of 
the RHC by inputting a rate command. 
It requires trim to be enabled and flight 
controller power on, and the CDR or 
PLT to use the "beep trim" switch on 
their RHC. Any input by the RHC rate 
trim will be zeroed if the pitch axis is 
returned to AUTO. This switch is used 
to perform the beep trim derotation 
during landing rollout. 


® Nose-up turn compensation provides а 
pitch rate as a function of steady state 
turn yaw rate and bank angle during 
bank maneuvers in MM 305. This 
provides a constant flight path angle 
without the crew having to make a pitch 
adjustment during turns. 


e At nose gear touchdown, the pitch axis 
will mode to AUTO and auto-load relief 
will move the elevons down to off-load 
the main gear. (This is the only entry 
phase auto flight control feature in the 
BFS.) 
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Because of the very high angles of attack (a) 
that the orbiter flies, there is a large difference 
in the velocity vector and the body X axis. For 
conventional airplanes that fly at small a, a 
body axis roll is very close to a velocity vector 
bank. (Bank refers to a rotation about the 
velocity vector, or a stability axis rotation. Roll 
refers to a rotation about the X axis or a body 
axis rotation.) But at an a of 90°, a velocity 
vector bank is a body axis yaw. Therefore, at 
a=40° (the orbiter's angle of attack from ММ 
304 transition to Укы, = 10,500 fps), a velocity 
vector bank requires a combination of a body 
axis roll and body axis yaw. 


Another very important feature of the orbiter 
during early entry (Увы, > 4,000 fps) is that the 
vehicle rolls and yaws due to sideslip (B). Beta 
can be generated by either yaw jets or the 
adverse yaw caused by aileron displacement. 
(Adverse yaw means instead of rolling because 
of the increased lift caused by moving an 
aileron down, the vehicle will yaw because of 
the increased drag caused by moving an aileron 
down. This yaw produces f.) Therefore, 
adverse yaw is purposely used during early 
entry to start a bank by using "reverse aileron" 
(right aileron down when initiating a bank to 
the right) along with yaw jets to develop a В to 
get the vehicle banking. One of the two 
purposes of a gain called GALR is to determine 
whether the first output from the roll channel is 
reverse or proverse aileron, and how big the 
output should be. (Basically, no initial aileron is 
used until qbar-10 psf, reverse aileron is used 
from qbar-10 psf until approximately Увн, = 
3,800 fps, and steadily increasing proverse 
aileron from Уви. = 3,800 fps.) However, once a 
В has been induced, it must be controlled. More 
precisely, the change in В must be made zero 
when the desired bank rate is achieved. 
Proverse aileron, used їп Ње proper 
relationship to compensated body axis yaw and 
о, is introduced after the bank has been started 
to control B and maintain the bank rate. This is 
called “beta dot damping", and GALR controls 
how much aileron is used for damping and 
when it is terminated. Beta damping is used 
from qbar-2 psf until Уке. = 900 fps, although it 
starts ramping down at approximately Увы, = 
3,800 fps. 
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Roll channel is driven by either the auto system 
via bank angle error, which is turned into a 
bank rate command, or by CSS via RHC input. 
This bank rate command is multiplied by (1- 
GALR) to determine if the initial command 
should be reverse or proverse ailerons. It is 
converted into a roll rate command and is 
summed with beta dot damping (which is 
multiplied by GALR to determine magnitude) 
and compared with the output from the roll axis 
RGAs after compensation for roll rates from the 
steady-state turn. This is the rate error that is 
turned into jet commands until qbar-10 psf 
and/or aileron commands after qbar-2 psf. 


The Entry Mode Switch, also known as the Roll 
Mode Switch, on the CDR L2 panel, allows the 
crew to select one of three Aerojet DAP flight 
control modes. The switch positions are Auto, 
Low Gain, and No Yaw Jet. Auto allows 
selection, via Override SPEC 51, of either the 
baseline or Wraparound DAP roll modes. 
Wraparound DAP provides the same GALR 
terms as the No Yaw Jet mode, which are seven 
times that of the baseline GALR term Юг Уве > 
4,000 fps. Wraparound DAP is the nominal 
entry roll mode. With increased GALR, 
Wraparound DAP decreases RCS propellant 
usage by using the ailerons as the primary 
control effectors and the RCS jets as 
supplemental control effectors. 


The No Yaw Jet entry mode eliminates all yaw 
jet commands. Bank maneuvers are accom- 
plished only with aileron commands. This 
flight mode is certified for qbar >20 psf (or very 
soon after the first non-zero bank) to landing. 
No Yaw Jet will be used in critical entry cases of 
low aft RCS propellant (<10% total quantity) or 
loss of aft RCS yaw jets. 


The Low Gain position cuts the GALR terms in 
half, using both yaw jets and ailerons for 
control. This mode may be selected in off- 
nominal situations because of airframe 
vibrations or oscillations. 


Other features of the roll channel are: 


e Roll channel trim is automatic in AUTO 
until rollout. Because auto trim in CSS 
is terminated at Mach 1.25, if CSS is 
taken at Mach >1 while the vehicle is 
maneuvering, such as rolling onto the 
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НАС, the CDR may experience a roll 
rate on final that must be compensated 
for by displacing the RHC slightly to the 
right or left. This is because the 
automatic trim input during the 
maneuver is “locked” into the flight 
control system when CSS is taken. This 
usually becomes apparent when rolled 
out on final. The RHC roll trim may be 
used to trim the RHC. 


е RHC roll rate trim is exactly the same ав 
pitch rate trim. 


e At main gear touchdown, auto load 
balance keeps the wings level during 
rollout and prevents the downwind tire 
from experiencing excessive loads with 
crosswinds. After nose gear 
touchdown, load balance is faded out 
over 100 seconds. 


e Any yaw jet firing causes the ailerons to 
trim in the proper direction to reduce 
the number of jet firings (right yaw jet 
firings will cause right aileron to trim 
down). 


Except during bank maneuvers, DAP attempts 
to keep В small throughout entry. Until Mach 
0.6, the yaw channel is driven by bank angle 
error, which is turned into a bank rate 
command. After Mach 0.6, the yaw channel is 
driven by the roll rate compensated for steady 
state turn so rudder pedal inputs are not 
required to maintain coordinated flight. The 
bank rate command or the compensated roll 
rate is converted to a body yaw command and 
summed with a beta compensation term until 
qbar=20 psf. That is compared with the output 
from the yaw axis RGAs after compensation for 
yaw rates from the steady state turn. This yaw 
rate error is then summed with lateral 
acceleration (Ny), RPTA input, and yaw panel 
trim inputs. This is the rate that is turned into 
jet commands until Mach 1 and/or rudder 
commands after Mach 5. This causes the beta 
during early entry to cause the orbiter to bank, 
or during late entry (M < 0.6), coordinates the 
bank. 
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The rudder is not active for control until M < 5.0 
due to the high angle of attack on entry 
essentially blanking the vertical tail/rudder 
from the airstream. Once the angle of attack 
decreases, the rudder is blended into the flight 
control system. 


Other features of the yaw channel are: 


е The RPTA does not directly control the 
rudder, but commands lateral accelera- 
tion, and the rudder moves as necessary 
to maintain that lateral acceleration. 
Yaw panel trim performs exactly the 
same function. There is no operational 
reason to command a non-zero lateral 
acceleration. The RPTAs are not active 
until the rudder becomes active at 
M< 5.0. 


e At GSENBL set (WOW set for 2 sec, 
theta < 0 deg, WONG), if in AUTO R/Y, 
the yaw channel will provide nose 
wheel steering commands to maintain 
runway centerline. 


Operations 


Ascent 


The terminal count phase extends from T-20 
minutes through SRB ignition. During this 
timeframe, the GNC OPS 1 software is loaded 
into the GPCs and verified by the ground. 
Guidance and flight control software are not 
active during terminal count. Navigation 
software is initialized at T-8 seconds when the 
onboard state vector is initialized and state 
vector propagation begins. 


First-stage guidance is active from SRB ignition 
through SRB separation command. Іп this 
stage, guidance uses а preflight planned 
("canned") table of roll, pitch, and yaw attitudes 
referenced to relative velocity. In addition to 
sending commands to flight control to obtain 
proper attitudes, the guidance software also 
sends commands to the MPS throttle per a 
preflight defined throttle schedule. Steering of 
the vehicle during first stage is accomplished by 
gimballing primarily the SRB nozzles. First- 
stage guidance also attempts to relieve vehicle 
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aerodynamic loads 


accelerations. 


The navigation software during first stage 
propagates the vehicle state vector using the 
Super-G integration scheme using IMU data 
and a gravity model. 


The flight control software during first stage 
uses commands issued by guidance. If the crew 
has selected CSS, commands are input through 
the RHC. Feedback from rate gyro assemblies 
and accelerometers is used to generate 
commands to reposition the SRB nozzles and 
main engine bells. The current vehicle attitude 
rates and the errors between current and 
desired attitudes are sent to the attitude director 
indicator for display to the crew. If the crew 
does take CSS, the resultant control mode is 
discrete rate/attitude hold. In this mode, when 
the rotational hand controller is moved, a 
specified attitude rate is commanded as long as 
the RHC is out of its neutral position. When the 
RHC is in detent, attitude hold commands are 
generated by flight control. 


During first stage, no GNC-related crew actions 
are planned unless a failure occurs. Following 
launch, the crew uses the Ascent Flip Book for 
general procedures. To ensure that the auto 
flight control system is maintaining the 
expected ascent profile, the crew can scan the 
cue cards placed next to the dedicated displays. 


Second-stage ascent begins at SRB separation 
and extends through MECO and external tank 
separation. During second stage, the crew 
monitors the onboard systems to ensure that the 
major GNC events occur correctly. These events 
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include closed loop guidance convergence, 3-g 
throttling, MECO, external tank separation, and 
-Z translation. 


The second stage guidance software uses a 
cyclic, closed loop scheme to calculate the 
necessary commands to take the mated vehicle 
to a specified set of target MECO conditions. 
These conditions include cutoff velocity, radius 
from the Earth, flight path angle, orbital 
inclination, and longitude of the ascending 
node. The name of the targeting scheme is PEG 
(powered explicit guidance) 1. 


The predicted time of MECO (TMECO) is 
calculated by both PASS and BFS and displayed 
on their respective ASCENT TRAJ displays for 
the crew to evaluate. (Adiscrepancy between 
PASS and BFS may indicate a guidance error, 
requiring the crew to take manual control.) 
Following SRB separation, it may take the PEG 1 
guidance algorithm several cycles to converge 
and for TMECO to become stable. Forty seconds 
prior to MECO, guidance begins targeting only 
for the desired cutoff velocity. 


Guidance software also governs the main 
engine throttle commands such that 3 g's are 
not exceeded. The crew can ensure that 3 g's 
are not exceeded by monitoring the g-indicator 
on either the BFS ASCENT TRAJ 2 display or 
the Ascent/Entry Flight Display. 


Second-stage navigation software continues as 
it did during first stage; i.e., it propagates a state 
vector using the Super-G integration scheme. 
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Second-stage flight control software continues 
through MECO as it did during first stage, with 
the exception of gimballing the main engines 
versus the SRBs. After SRB separation, attitude 
hold is commanded until guidance converges. 


At MECO, the transition (or TRANS) DAP, 
becomes active. Initially it sends attitude hold 
commands. External tank separation 18 
automatically commanded about 20 seconds after 
MECO. The DAP immediately sets commands to 
fire the orbiter -Z RCS jets resulting in the orbiter 
translating in the -Z direction (away from the 
external tank). When -4 fps delta velocity is 
reached, the fire commands are removed. 
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Orbit Insertion 


During the orbit insertion phase, the guidance 
software is used to target the OMS 2 burn (and 
OMS 1 burn, if required). The primary 
targeting scheme used is called PEG 4. This is a 
cyclic, closed loop scheme that computes the 
required delta velocity to achieve a specific 
point in space and a specific flight path angle. 


Navigation during the orbit insertion phase is 
identical in processing to that used in the 
mainstage whenever the | IMU-sensed 
acceleration is greater than the noise threshold. 
If the IMU-sensed acceleration drops below the 
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threshold, navigation ignores the IMU data and 
propagates the state vector using an 
atmospheric drag model of the orbiter. 


Insertion flight control is accomplished using 
the transition DAP. The transition DAP uses 
commands from guidance for automatic 
maneuvers to burn attitude using the RCS jets. 
During the OMS 1 and 2 burns, it uses the OMS 
engines and RCS jets as required. It can also 
receive commands from the crew ма the 
forward THC and RHC. The transition DAP 
takes these commands and converts them into 
the appropriate RCS commands. It then 
monitors the resultant attitude and attitude 
rates. Тһе necessary commands are sent to 
achieve the targeted attitude and attitude rate 
within the pre-mission specified deadbands. 


For rotations, the crew selects either AUTO or 
INRTL control on the ORBITAL DAP panel or 
by moving the RHC. In translation, movement 
of the THC results in continuous jet firings. 


Orbit GNC 


The major GNC-related orbit tasks include 
achieving the proper position, velocity, and 
attitude necessary to accomplish the mission's 
objectives. То do this, the GNC software 
maintains an accurate state vector, maneuvers 
to specified attitudes and positions, and points a 
specified orbiter body vector at a selected target. 
These activities are planned with several 
constraints in mind, including fuel 
consumption, vehicle thermal limits, payload 
requirements, and rendezvous/ proximity 
operations considerations. The GNC displays 
for the majority of on-orbit operations are OPS 
201 UNIV PTG and MNVR EXEC. Both are 
available in OPS 2, and MNVR EXEC is 
available for the orbit portion of OPS 1 and 3. 


The navigation software has several important 
features. Аз before, it propagates the orbiter 
state vector using the Super-G integration 
scheme. During coasting flight, the software 
uses a model of atmospheric drag acceleration 
to propagate the state vector. Another 
navigation option that is available on-orbit is 
called rendezvous navigation. | When this 
option is enabled by a crew input on the REL 
NAV display, the software propagates a target 
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state vector, as well as the orbiter state vector. 
In this mode, navigation can use external sensor 
data from the star tracker, rendezvous radar or 
COAS, in computing the orbiter/target relative 
state vector. 


For vehicles equipped with three-string GPS 
hardware, the navigation software will replace 
its propagated vector with a selected GPS vector 
every 90 minutes. This will happen only if the 
selected GPS state vector falls within the 
navigation software’s expected error. After the 
orbiter vector is updated, it will then be 
propagated for the next 90 minutes using the 
same techniques as described above (i.e., Super- 
G, drag model, etc.). This automatic GPS state 
vector update will be inhibited during 
rendezvous operations to avoid interfering with 
the current rendezvous navigation sensor 
processes. 


For vehicles with single-string GPS, periodic 
updates are sent from Mission Control to 
correct any errors that develop with the 
onboard nav state. In the event of no-comm, 
GPS can be incorporated as described above. 


The on-orbit guidance software has several 
features. Universal pointing is used to compute 
attitude changes required to "point" a specified 
orbiter body axis at a specified target, to 
maneuver to a predetermined attitude, to rotate 
the orbiter about a specified body axis, or to 
maintain attitude hold. The crew interacts with 
this software via the UNIV PTG display. 


Another guidance feature is PEG 7, or external 
AV, targeting for OMS or RCS burns. In this 
mode, guidance sends the commands to flight 
control to execute a burn specified by an 
ignition time (TIG) and delta velocities in the 
local vertical coordinate system at ignition. 


Commands continue to be generated until the 
original AV requirement is met. The crew 
monitors this option with the ORBIT MNVR 
EXEC display. 
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The third guidance capability is an on-orbit 
targeting scheme used to compute the burn 
parameters required to move the orbiter to a 
specified target offset position in a given 
amount of time. This capability is used to do 
on-board targeting of rendezvous maneuvers. 
The crew monitors this feature using the SPEC 
34 ORBIT TGT display. 


The orbital flight control software includes the 
RCS DAP, OMS ТУС DAP, an attitude 
processor, and the logic to govern DAP 
selection. The attitudes calculated by the 
attitude processor are displayed on the ADI and 
the UNIV PTG display screen. The vehicle 
attitude is used by the DAP to determine 
attitude and rate errors. 


Options for the DAP, including the translation 
rate, rotation rates, and deadbands, are 
changeable by the crew during the orbit phase 
using the DAP CONFIG display. The Flight 
Plan specifies which DAP configurations should 
be loaded at each time in the mission. 


Deorbit 


The deorbit phase of the mission includes the 
deorbit burn preparations, the loading of burn 
targets, the execution and monitoring of the 
burn, post-burn reconfiguration, and a coast 
mode until about 400,000 feet above the Earth's 
surface. The deorbit and entry flight software is 
referred to as OPS 3. 


During the deorbit phase, navigation uses the 
Super-G algorithm to propagate the orbiter state 
vector, based upon a drag model or IMU data. 
Navigation maintains and propagates three 
orbiter state vectors, each based upon a 
different IMU. From these three state vectors, a 
single orbiter state vector is calculated using an 
interchangeable mid-value selection process. A 
single-state vector is passed on for use by 
guidance, flight control, dedicated display, and 
DPS display software. Three separate state 
vectors are propagated to protect the onboard 
software from problems due to two IMU data 
failures. This three-state vector system is only 
used during entry, since that phase is most 
critical with respect to navigation errors and 
their effects on vehicle control and an accurate 
landing. Another feature available during this 
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phase is the software computational capability 
of a statistical estimate of the error in the state 
vector propagation, to be used later in flight when 
external sensor data are available. Also in this 
phase, it is possible for the crew or Mission 
Control to input a delta state vector to correct 
navigation. 


Vehicles with three-string GPS hardware will be 
able to incorporate a selected GPS state vector 
every 42 seconds throughout the deorbit and 
entry phases of flight. This will be initialized via 
crew command upon entering OPS 301. Similar 
to orbit, the nav software will pick the best 
available GPS vector to replace the three IMU 
propagated state vectors. These three updated 
vectors will continue to be propagated as 
described above for the next 42 seconds, at which 
time they will be replaced with a new selected 
GPS vector and then the process will repeat. 


Guidance during the deorbit phase is similar to 
that used in the orbit insertion phase. The PEG 
4 scheme is used again to target the deorbit 
burn and guide the vehicle during the burn 
although the required conditions are different. 
The deorbit burn targets ensure the proper 
conditions for entry interface, including 
altitude, position with respect to the Earth (and 
landing site), and velocity/flight path angle 
constraints. These deorbit burn targets are 
specified preflight for a nominal mission, 
although it is also possible for the ground to 
uplink changes or for the crew to recompute 
them onboard. It is also possible to specify 
OMS fuel "wasted" (burned out of plane) during 
the deorbit burn in order to establish an 
acceptable orbiter center of gravity (c.g.) for 
entry. The crew is responsible for loading these 
targets on the DEORB MNVR EXEC display. 


The display is used to set up and target the OMS 
burn, to specify fuel to be wasted, to display the 
required burn attitude, to initiate an automatic 
attitude maneuver, and to monitor the progress 
of the burn. The crew's task for deorbit guidance 
includes ensuring the correct burn targets are 
entered on the DEORB MNVR EXEC display, 
"loading" this target for PEG 4 deorbit burn 
guidance software, and maneuvering to 
calculated and displayed burn attitude either in 
AUTO or manually using the RHC. The burn 
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itself is typically executed in AUTO such that the 
crew's task is to monitor the burn progress in 
terms of velocities and OMS performance. 


Flight control during the deorbit phase is 
similar to the procedures used during orbit 
insertion - the transition DAP is again in effect. 


Entry 


The entry phase of flight is subdivided into 
three separate subphases because the software 
requirements for each are different: 


e The ENTRY subphase extends from EI-5 
to the point at which the vehicle is 
traveling at 2500 fps (83,000 ft altitude). 


e The terminal area energy management 
(TAEM) subphase begins at 2500 fps and 
extends to the approach/landing capture 
zone, defined when the vehicle is on 
glide-slope, on airspeed, and on runway 
centerline (below 10,000 ft altitude). 


e The approach/landing (A/L) subphase 
begins at the approach/ landing capture 
zone and extends through wheel stop 
after touchdown. 


The guidance software during the entry portion 
of flight performs different tasks during each of 
the ENTRY, TAEM, and A/L subphases. 


During the ENTRY  subphase, guidance 
attempts to keep the vehicle on a trajectory that 
provides | protection against | excessive 


temperature, dynamic pressure, and normal 
acceleration (Nz) limits. То do this, the 
software sends commands to flight control to 
fly a drag/acceleration determined profile, 
which guides the vehicle through a tight 
corridor limited on one side by altitude and 
velocity requirements for ranging (in order to 
make the runway), and on the other side by the 
thermal, qbar, and Nz constraints. Ranging is 
accomplished by adjusting drag acceleration to 
velocity such that the vehicle stays in that 
corridor. Drag acceleration can be adjusted by 
modifying the angle of attack, which changes 
the vehicle's cross sectional area with respect to 
the airstream, or by adjusting the vehicle bank 
angle, which affects lift and thus the vehicle's 
sink rate into denser atmosphere. The vehicle's 
angle of attack is maintained at a high value 
(a=40°) during most of this phase to protect the 
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upper surfaces from extreme heat. It is ramped 
down to a lower value at the end of this phase 
for vehicle controllability. Using bank angle to 
adjust drag acceleration results in the vehicle 
turning off course. Therefore, at certain times, 
the vehicle must be rolled back toward the 
runway. This is called a roll reversal and is 
commanded as a function of azimuth error from 
the runway. 


During the entry phase of flight, the crew uses 
IDP displays, dedicated displays, certain panel 
switches (such as TRIM switches), the RHC, and 
the SBTC to control the vehicle. Between the 
ENTRY interface and the TAEM interface, five 
ENTRY TRAJ displays sequentially become 
available. These displays are used to monitor 
autoguidance and the vehicle's trajectory 
compared to the planned entry profile. The five 
displays are identical with the exception of the 
central plot, which shows vehicle velocity 
versus range or energy/weight versus range 
with a changing scale as the vehicle approaches 
the landing site. This central plot also includes 
static background lines that allow the crew to 
monitor the vehicle's progression compared to 
planned entry profiles. 


Once TAEM interface is reached, the VERT SIT 1 
display becomes available. This display includes 
a central plot of vehicle altitude with respect to 
range. The plot has three background lines that 
represent the nominal altitude versus range 
profile, a dynamic pressure limit profile, and a 
maximum lift-over-drag profile. At 30,000 feet 
altitude, the scale and titles on the display change 
to VERT SIT 2. This second display is used 
through landing. When the A/L interface 
conditions are met, a flashing A/L is displayed 
on the VERT SIT 2 display. 


Guidance software during TAEM generates the 
necessary commands to enable the vehicle to 
achieve the proper A/L conditions by following 
an energy / weight versus range profile. During 
TAEM, as the name implies, the goal is to 
manage the vehicle's energy while the orbiter 
travels around an imaginary arc called the 
heading alignment cone (HAC). A HAC is an 
imaginary cone that when projected on the 
Barth, lies tangent to the extended runway 
centerline. 
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The guidance software performs the TAEM 
function as follows: 


e S-Turns: If the vehicle is high on 
energy, it dissipates the excess by 
turning away from the HAC until the 
proper energy conditions are met. 


• HAC Acquisition: Turns the vehicle 
toward the targeted tangent point on the 
HAC and flies to this point. 


е Heading Alignment: Flies the vehicle 
around the HAC to the point at which 
the HAC is tangent to the runway 
centerline, called the nominal energy 
point (NEP). 


e Prefinal: From the NEP, flies the vehicle 
down the runway centerline until the 
proper A/L conditions (airspeed, 
altitude, flight path angle, distance off 
centerline) are met. 


Within the above steps, TAEM guidance makes 
the necessary adjustments to account for 
various energy conditions. 


Approach/landing guidance software com- 
mences when the vehicle is about 10,000 feet 
altitude (at 5.8 or 6.3 nm range from the runway 
threshold) and near the proper altitude, air- 
speed, and flight path angle for the outer glide 
slope (20° or 18°, depending on orbiter weight). 
The guidance software sends commands to 
keep the vehicle tracking the runway centerline 
and on the steep glide slope until 
approximately 2000 feet, at which point a pre- 
flare maneuver is performed to put the orbiter 
on a shallow glide slope (1.5?). Final flare is 
initiated between 30 and 80 feet (based on sink 
rate), reducing the sink rate to 3 fps for 
touchdown. At this point, guidance software 
generates commands directing the vehicle to the 
runway centerline. 


Їл the entry phase, navigation software 
functions similarly to the deorbit phase (i.e., 
three-state vectors computed using the Super-G 
algorithm corresponding to each inertial 
measurement unit) with the exception that 
additional external sensor data are sequentially 
incorporated. This information is used to 
provide the accuracy necessary to bring the 
orbiter to a pinpoint landing and to some extent 
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to maintain vehicle control. The TACAN 
system provides slant range and magnetic 
bearing to various fixed stations around the 
landing site and becomes available at about 
160,000 feet altitude until 1500 feet above 
ground level. Тһе АПТА system provides 
pressure data to compute angle of attack, Mach 
number, equivalent airspeed, true airspeed, 
dynamic pressure, barometric altitude, and 
altitude rate. Only barometric altitude is used 
for the navigation software. The microwave 
landing system precisely determines slant 
range, azimuth, and elevation to the ground 
stations located along the side of the landing 
runway. When landing at runways with 
microwave landing system ground stations, 
data become available at 18,000 feet for 
processing by navigation. 


Another tool used by the navigation software is 
a "software sensor" called drag altitude, which 
uses a model of the atmosphere to correlate the 
drag acceleration measured by the inertial 
measurement units to altitude. The drag 
altitude data ате important in keeping 
downrange and altitude errors bounded until 
TACAN data is available. 


The navigation software also maintains a 
statistical estimate of the expected error in the 
state vector. When an external sensor, such as 
TACAN, becomes available to the navigation 
software, a check is made to see if the data lays 
within the current expected range of error. 
Crew controls are provided on the HORIZ SIT 
display to force the software to accept or inhibit 
the external sensor data regardless of whether 
they lie within this expected range. There is 
also a control on the display that may be 
selected to allow the software to use the 
external sensor data to update its state vector as 
long as the data lie within the expected range. 
This scheme is part of what is called Kalman 
filtering and is used to prevent navigation from 
being polluted by bad sensor data. The 
navigation parameters computed as a result of 
this filter can be seen by the crew on the 
dedicated displays when NAV is selected as the 
data source. In addition to providing insight 
and control over navigation parameters, the 
HORIZ SIT display supplies the crew with 
spacecraft position and heading information. 
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GPS-equipped vehicles will not have ТАСАМ 
data to incorporate into the three-state vectors 
corresponding to each IMU. Similar to the other 
navigation sensors, GPS data are constantly 
checked to make sure they lie within an 
expected error range. Crew controls (via the 
HORIZ SIT display) allow the navigation 
software to automatically incorporate a GPS 
vector if the vector falls within the expected 
range or to force the software to accept or 
inhibit the data regardless of whether the 
information lies within the expected range. As 
described in the Deorbit subsection, navigation 
software will select and incorporate a GPS 
vector every 42 seconds up to 17,000 feet and 
then every 9 seconds thereafter to allow for 
smoother updates to navigation software in the 
event that MLS is not available. If MLS is 
available, MLS will update navigation software 
as described above and GPS updates will 
automatically be inhibited by the navigation 
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GNC Caution and Warning Summary 


e IMU overheating or BITE-detected failures 
display a fault message and annunciate an 
SM ALERT. An IMU failure illuminates the 
SM ALERT and displays a fault message, 
while a dilemma illuminates the IMU C/W 
light on panel F7. 


A TACAN, GPS, or microwave scanning 
beam landing system (MSBLS) fault will 
illuminate the SM ALERT and display a fault 
message. 


Fault detection in the air data system 
illuminates the SM ALERT for a failure or 
the red AIR DATA and BACKUP C/W 
ALARM lights on panel F7 for a dilemma, in 
addition to sounding an alarm апа 
generating a fault message. 


The RGA/ ACCEL light on panel F7 is not 
supported. RGA or AA failure will sound an 
alarm and generate a DPS fault message. 
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A malfunction in the commander's RHC will 
illuminate the LEFT RHC light on panel F7; a 
malfunction in the pilot's RHC or the aft RHC 
will illuminate the RIGHT/ AFT RHC light. 


If the hydraulic system pressure drops below 
2,800 psi, the HYD PRESS and BACKUP 
C/W ALARM lights will illuminate. 


The yellow FCS CHANNEL light illuminates 
to indicate a failed channel; the red FCS 
SATURATION light is illuminated if one of 
the four elevons is set at more than +12° 
(down) or less than -15° (up). 


The OMS TVC light illuminates if the left or 
right OMS gimbal fails, or if software detects 
a TVC failure. 


The LEFT or RIGHT OMS light illuminates if 
the left or right OMS engine fails. 
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GNC Summary Data 


e GNC systems determine the current state of 


motion of the vehicle, compute actions to 
change its state of motion, and apply 
corrective maneuvers to achieve the change. 


GNC elements are navigation and flight 
control system hardware апа digital 
autopilot software. 


A bad orbiter navigation state can degrade 
flight control, since navigation data are used 
to set control gains and choose control 
effectors. 


Navigation hardware includes: (1) IMUs, 
which sense vehicle orientation апа 
accelerations; (2) star trackers, which sense 
vehicle line of sight vectors; (3) COAS, which 
allows the crew to manually determine line 
of sight vectors; (4) TACAN, which senses 
vehicle position with respect to a ground 
based station; (5) GPS, which senses satellite 
ranging signals to determine orbiter position 
and velocity; (6) air data system, which 
senses temperature and pressure; (7) MLS, 
which senses vehicle position with respect to 
a ground-based station along the runway; 
and (8) radar altimeters. 


The flight control system hardware includes 
four accelerometer assemblies, four orbiter 
rate gyro assemblies, four SRB rate gyro 
assemblies, rotational and translational hand 
controllers, rudder pedal transducer 
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assemblies, two speed _ brake/thrust 
controllers, two body flap switches, panel 
trim switches, aerosurface servoamplifiers, 
and ascent thrust vector control. 


DAP software interprets maneuver requests, 
compares them to what the vehicle is doing, 
and generates commands for the appropriate 
effectors. 


Different DAPs function during different 
flight phases. Transition DAP (TRANSDAP) 
becomes active at МЕСО; orbit DAP includes 
an RCS DAP, an OMS TVC DAP, and an 
attitude processor module. TRANSDAP is 
used again for the deorbit burn until EI-5 
minutes. Aerojet DAP is used from EI-5 
until wheel stop on landing. 


Primary GNC-related switches апа 
pushbuttons are located on panels C3, A6U, 
F2, F3, and F4. Other switches, pushbuttons, 
and circuit breakers are located on the 
following: F6, F7, F8, O5, O6, C7, O8, O9, 
O14, O15, O16, O17, and L1. 


GNC-related information and crew access 
are provided by several displays: GNC SYS 
SUMM 1, IMU ALIGN, GND IMU 
CNTL/MON, S TRK/COAS CNTL, HORIZ 
SIT, MNVR, UNIV РТС, DAP CONFIG, 
PASS ASCENT TRAJ 1, PASS ASCENT 
ТКАЈ 2, ВЕБ ASCENT ТКАЈ 1, BFS ASCENT 
TRAJ 2, REL NAV, ORBIT TGT, ENTRY 
TRAJ 1-5, VERT SIT 1, VERT SIT 2, and GPS 
STATUS. 


USA007587 
Rev. A 


а M FCS CHANNEL @ Є) 
© : m У RAE : о. pem ! 5 4 © Ө 
> OVERRIDE 
жа АНМ ом 1+2 
BODY FLAP 
e, : bs 
R R и N 
и H A < > A 
Ж 4 у у 
Р Р Bue T 
R R 2 0 м2, ыг 0 
E E брза) AUTO/ 
5 5 OFF 
5 5 (89 
© in Е 
> OFF 
(G3 
Га @ Ry) 
DOWN A 
ков $10/——] Р MAIN ENGINE i 
LEFT RIGHT x ЗНА SHUT DOWN Р KEEN TRIN 
ENABLE ун CTR 
» А к= 2-2, 
L LEFT ЈЕ RIGHT 
А 
e € 1Ө к= 
) т 
|, 0 
(sit) LEFT RIGHT 
518) (340 ~ (512) АВ! | АВ2 0514) 
INHIBIT —— ЕРІ! ЕЕ? ОРА — 
INHIBIT ————Z c 
3 5) @ 862 | СА? САЗ | BCS D D fe 
ele @ ӨЗ") Eu me EALO © © 
© G VE 
2 (е 5) Б) 
өө © || Е а ао © 
; ORBITAL DAP : ) MAN/ AUTO МАМ @ 
с го 
р SELECT ү CONTROL j Б 
Ж 
© 
A B AUTO INRTL LVLH FREE 
XXX XXX EXXX ххх 
pe ||| ||| sen (Siw isoo ||| [LS || || || сг la 
(ббй, 
r MANUAL MODE- 1 цар 
t TRANSLATION тг ROTATION 1 
х Y z ROLL PITCH YAW 
9 
an Low Z HIGH 2 PRI ALT VERN (есу об 
(511214) f Келте || ||| супе 
ы AUDIO. р 01 РСММУ—— 
CENTER PUR FORMAT CONTROL 
: DISC DISC DISC 1 1 eec смо Fv, в 
NORM NORM NORM PATE E RATE м 
(е || | 22858! Евней Бәле) Би) Бе Е LL АРТ f JR AFT 
0 = ] | 
16914 oh ! | 
5 5 \ i (с) (051) LL FUD | $m LR ғыз 
ТЕЗ! ТЕЗ eucse|| || ЕЗІ ТЕЗ = Е = | @ 
БРРЬ! етен Ба ШЕ Бен @ “ҚС LR AFT 
ЕЈ ЕД E c» [ 
= — | = 2 2 PROGRAM PANEL = 
PAUSE ғ) 
2) Р 
Э © PIG > 5 Mos (8 
e| 6 3 © © © Ө! Ф 
ЕЛЕУЛІ 
m AIR DATA PROBE——— Ө MASTER г CAUTION/wARN ING |@) 
Ө) ЕРТ RIGHT _® UPLINK > MADS POWER Ө МЕМОВҮ MODE © 
/ DEPLOY/HEAT [———— FUEL CELL REACT МУ — NSP BLOCK ом “МУ READ Y ACK 
1 2 3 с 
` CLOSE У @ (GE) р ш в AN 4 
@ ® Ө: ла R (QI. 
D D B (5) п (©) ( ЖЕ 
Е E L R L 
P Р 0 м 
L L с р 
o o = ET сиз 1814) 1% sn | 
T T ENABLE OFF CLEAR A — ASCENT R 
25 = Не — PAYLOAD SAFING — E 
Ф N Е SY EMERGENCY 
© © © = : я : O Оо c 
SZ “2 Шу моям ON/OFF Т 
STOW (cat) tcB2) 1683) 
CLOSE ENA 0 
4 A @ 2 
D 
A бу 
@ @ + @ = Ха = = = 0 
cosa Р 
| isn sn (sh 7 
NI TA O GG 
@®) © 
@| ® ® > 9 © 


(35/2 3ЗАЗА5) 


Рапе! СЗ 


2.13-67 


2. SYSTEMS 


2.13 Guidance, Navigation, and Control (GNC) 


USA007587 
Rev. A 


DRAG CHUTE 


JJ 
2 


Panel F2 


ла || ROLL/ 


YAM 


HUD 
POWER 
ох 


ТАМ 
AHO/PNL PANEL 
ON 


ENABLE 


Ф| энэ FAIL | ЕЗ (e ANT) КО e) 


й 


INHIBIT OFF 


Panel F3 


DRAC CHUTE 


A. ROLL/ 
24 YAW 


AUTO 


(ЕЕ 23 
bw | IL 
IEEE 


Ens © 
ES [I L | F4 
МАМ || HAN | 
| LEmw БЕТІ) 


ZAAN) Ln 
as ли 
SPD BK/ BODY 
THROT FLAP 


А 


2. SYSTEMS 


Рапе! Е4 


213-68 


2.13 Guidance, Navigation, and Control (GNC) 


1 000/02:46:03 
000/00:00:00 


2011/ /018 


GNC SYS SUMM 1 


GPC 
MDM FF 
FA 


usa007587203 


GNC SYS SUMM 1 Display 


1 000/02: 46:03 
000/00: 00:00 


DPS 12345 
GPC 
MDM FF 
FA 


2011/ /018 GNC SYS SUMM 1 


usa007587203 


GNC SYS SUMM 1 Display 
(Three-String GPS Vehicles) 


С 3011/021/ IMU ALIGN 1 006/09:34:09 
ІМ) 000/00:00:00 
1.2 3 
STAT IGN 
TEMP OK Ж Ж ІМ 110 STAR ALIGN 13* 
STBY 21 22 23 2 11 14 IMU/IMU 
OPER 4. 5 6 312 MATRIX 15 
DS 7 в 9 
EXEC 16 
TERM 17 
ACC 
1 2 3 
X -0.03 «0.01 -0.03 IMU BITE MASK 
y -0.02 -0.01 40.03 1 0000 24 
2 -0.01 -0.02 -0.03 2 0000 25 
3 0000 26 
ANG 
1 2 3 
X 299.07 299.16 299.12 
Y 339.17 339.09 2339.14 МАУ АУ THRESH 
Z 160.65 160.72 160.64 18 3840 
AX 40.00 40.00 40.00 
AY 40.00 +0.00 40.00 ММ READ 19 


40.00 


usa007587 463: 


IMU ALIGN Display (SPEC 21) 


2.13-69 


USA007587 


Rev. A 
io 9011/104/ GND IMJ CNTL/MON 2 150/12:20:13 
000/00: 44:47 
IMJ 1 2 3 
X 1. 0,00 4. 0.00 7 0.00 SEL IMJ 1 16* 
Y 2 0.00 5 0.00 8 0.00 217 
Z з 0.00 6 0.00 9 0.00 3 18* 
О 83.62 192.88 297.47 АТТ DET 19 
M 23.65 301.81 26.65 HNGR CAL A 20 
I 99.91 42.01 351.09 B 21 
IR 0.00 0. 00 0.00 С 22 
DV X -10.72 + 9.50 «25.73 PREFLT CAL 23 
Y 427.14 +6.88 - 9.28 GYROCOMP 24 
2 -13.24 429.74 -16.57 
DVRSS 32.04 31.96 31.98 INERTIAL 25% 
PLAT POS 26 
HOW 8000 8000 8000 ТЕВМ/ШИБ 27 
SM 0 00 00 
АТ ЗЕ ЗЕ ЗЕ 28 M WRITE 1 
ВЕА 29 
ри оч + . * ММ STATUS 
STBY 10 11 12 


30 SITE SEL 7 
ACTUAL 398 


usa007587_464.tif 


GND IMU CNTL/MON Display (SPEC 104) 
(available on OPS 9 only) 


f 3011/022/ 


5 TRK/COAS CNTL 1 006/09:35:06 


000/00:00:00 
$ ТЕК CNTL -Y -Z 5 ТАВЬЕ 1 2 3 
SELF-TEST 1 2 ТЕК 1р 15 43 0 
STAR ТЕК 3 4 4 MIN 1 1 0 
TGT ТЕК 5 6 ANG DIF 84.1 0.0 0.0 
BREAK TRK 7 8 ERR 0.02 0.00 0.00 
TERM/IDLE 9* 10* SEL 17% 18% 19 
$ TABLE CLR 20 
$ ТАК -У -2 СОА5 
REQD ID 1.0 12 0 REQD ID 21 . Q 
TRK ID 0 0 ADEG X -0.2 
S PRES Y 0.3 
AANG +0.00 +0.00 SIGHT MODE 22 
THOLD 13 0 14 0 АССЕРТ 23 
SHUTTER cL сі, CAL MODE 24 
MAN OP 15 16 DES 25 
STATUS POS +X 26 -Z 27* 
ABIAS 0.00 0.00 
UPDATE 28 29 


usa007587 468.tif 


S TRK/COAS CNTL Display 


С 2 099/19:96: ^Y 


3051/050/ HORIZ SIT :51 
AL 000/68:26:58 
INDEX 6 | 9 29.82 NAV DELTA 
e123 е 

41 LAND SITE _1 ЭРЧ aY 11 
PRI KSC15 3% . ü ө 

SEC KSC33 4 az 12 
TAC- 59 5 О ‘о 

GPS FOM RA ax 13 

1 46 о 9 | Das 

ду 14 

СМ L OVHD 6 9 ] 

HSI L Б о az 15 
AIM NOM 8 1.18 5.9K ^ ГОАО 16 
S/B МОМ 39 18 aT 116.09 
9.17 

к 

«ee Б7 GPS К 9.9 AZ- 5.73 


10013.tif 
HORIZ SIT Display (SPEC 50) 
(Three-String TACAN Vehicles) 
2. SYSTEMS 


2.13 Guidance, Navigation, and Control (GNC) 


USA007587 
Rev. A 


HORIZ SIT 


XX X DDD/HH:MM:SS 


2011/ / UNI V PTG 2 000/ 02: 44: 58 
DN дың CUR MNVR COMPL 02:55:29 000/ 00: 00: 00 
1 START TI МЕ . 0/000: 00: 00 
3210 АХ 10 CUR FUT CUR FUT 
[+] ХХХХХХ MWR OPTION | START ММА 18 RBST 25 X X 
41 XXXX SITE XX AY 11 5 R. 0.00 TRK 19 * CNCL 26 
PRI XXXXX 3x 5.0К | [+] XXXXXX 6P 0.00 ROT 20 DURATI ON 27 
SEC XXXXX ах о А2 12 7 Ү 0.00 CNCL 21 ХХ: ХХ: ХХ, ХХ 
[+] ХХХХХХ 
ТАЕМ TGT АХ 13 TRK/ ROT ОРТ! ONS ATT MON 
8 TGT ID 2 22 MON AXIS 1 +X 
G&N X XXXX 6 0 | [+] XXXX ERR TOT 23. 
9 RA 0.000 ERR DAP 24 
10 DEC | ]_0. 000 
11 LAT | ]_0.000 ROLL PI TCH YAW 
12 LON ]. 0.000 CUR 163.59 40.77 338.38 
13 ALT[ ] 0.0  REQD 304.04 139.80 342.99 
ERR + 74.86 - 62.92 + 86.93 
14 BODY VECTOR 3 RATE - 0.266 - 0.367 + 0.443 
XXXXX |. XXXXX |. XXXXX 15 P .90.00 
DES 31 DES 32 DES 33 16 Y 0. 00 
17 OM 270.00 
AZ RNG ALT 605 
XXX ХХХХ.Х — XXX.X 
usa007587 479a.tif UNIV PTG Display 


HORIZ SIT Display (SPEC 50) 
(Three-string GPS Vehicles) 


авы 


DAP CONF IG 1 090/02:55:09 


000/00:00:00 
PRI 1 DAP AO1| 2 ОАР BOL DAP EDIT 
ROT RATE 16 0.2000| 50 2.5000 3 DAP A... 
ATT DB 11 -5.00| 31 .3.80 4 DAP B... 
RATE DB 12 2.22) 3e 2.89 - 5 LOAD 
ROT PLS 13 9,190] 55 0.040 
COMP 14 ~200] 34 -888 
Р ОРТІОМ 15 АШ. 35 ALL 
Y OPTION 16 ALL 36 ALL NOTCH FLTR 
TRAN PRS 17 0.100) 37 9.199 ENA 6 
RATE 08 18 9.200) 38 0.200 XJETS ROT 
ЧЕТ ОРТ 19 ALL 33 ALL ENA 7 
# JETS го 2| 49 г 
ОМ ТІМЕ 21 8.08| 41 8.88 REBOOST 
DELAY 22 .8.00| 42 0.00 8 CFG 1 
VERN Э INTVL 
ROT RATE 23 2.2000 | 43 2.2000 -19.99 
ATT DB 24 .1.000| 44 1.000 
RATE ОВ 25 .920| 45 4829 
ROT PLS 26 92.010| 46 0.902 
СОМР У 
CNTL АСС 2 


522. 


DAP CONFIG Display 


1041/ 
OMS BOTH 1* 
L 2 BURN ATT 
R 3 24 R 083 AVTOT 
RCS SEL 4 25 Р 195 TGO 
26 Ү 300 
MNVR 27" VGO 


OMS 1 MNVR EXEC 1 000/00:40:23 


000/00:15:37 


x 
Ү 
2 


ВЕТ 4366 
ТРЕ 24:40 
GMBL HA HP 
L R 130 +129 
P +0.4 +0.4 130 + 9 
У +5.8 +5.8 


РЕГ 28* 29* 
5ЕС 30 31 
ОРР 32 33 


35 ABORT TGT __ 


FWD RCS 
ARM 36 
DUMP 37 
OFF 38* 

SURF DRIVE 
ON 39 

LOAD 22/TIMER 23 OFF 40" 


GMBL CK 34 


usa007587_526.tif 


MNVR Display 


2. SYSTEMS 2.13-70 
2.13 Guidance, Navigation, and Control (GNC) 


USA007587 


Rev. A 
10217 7 ASCENT TRAJ 1 1 888/88:88:83 10217 ASCENT TRAJ 1 5 808/80 :08:23 
006/608 :06:63 BFS 906/60:06:60 
CONT ABORT 
ЗЕО BLUE 
2 ARM 2ЕО BLUE 
4 ABORT 
5 ENA YAW STEER 
6 SERC 
THROT 188 
60 
7 INH DRP 1E0 
70 
DPS МЕМ) DPS MENU 
Pix MEDS MEDS ст | |Рзх MEDS MEDS сз 
М56 RST] |М56 ACHAUT М56 RST] |М56 АСКАУТ 
PASS and BFS ASCENT ТКАЈ 1 Displays 
1031/7 и ASCENT TRAJ 2 1 888/88:082:25 18317 ASCENT TRAJ 2 5 888/88:02:41 
980/08:82:25 BFS 000/08:00:08 
р +200 т 
26 со 26 25 со 26 
CONT ABORT тео 6:88 
ЗЕО GREEN : р 
2 ARM 2ЕО BLUE АН | A 1694 
4 ABORT 
R Lee 
5 ENA YAW STEER и Р pee Sig А —_ 
у Lae 
6 SERC ё 
Т 184 
ТМЕСО 88:23 
THROT 184 
PRPLT 73 
DROOP ALT 8 
TMECO 8:24 
7 INH ОБР 1Е0 -200 -4 2-4 
DPS MENU DPS MENU 
Pix MEDS MEDS FC1| P3* MEDS MEDS [Сз 
М56 RST||MSG ACHAUT IMSG RST||MSG ACHAUT 


PASS and BFS ASCENT ТКА] 2 Displays 


2.13-71 
2.13 Guidance, Navigation, and Control (GNC) 


2. SYSTEMS 


USA007587 


Rev. A 
3041/ | ENTRY TRAJ 1 1 010/18: 36:2 
үн 1/033/ REL NAV 2 004/23:05:28 a D 000/ 00: 12: 24 
000/00: 38:42 50 50 —— — ~ —À 10D 80 6D 
RNDZ NAV ЕМА 1* SV UPDATE ЯН / 2 
KU АМТ ЕМА 2% POS 0.01 4 1 BIAS[] 0 
MEAS ENA 3 VEL - DREF 14.8 
NAV STAT Р lo DES does а 49:24 150 
SV SEL 4 FLTR RR GPC 1$ ХХХХ ХХХХХ 31X 1 A AZ +13.7 
RNG 97.692 RNG 97.567 ХХХХ ХХХХХ 32X + 
в - 41.55 R  - 41.30 ХХХХ ХХХХХ 33Х ара ВК. сын 2 
e 11.35 EL - 0.7 SV TRANSFER er 
Y - 0.04 А2 + 0.1 FLTR MINUS PROP l 
Y - 0.3 оғ + 1.1 POS 3.74 ЯН 240 
NODE 23:48:54 ов + 0.0 VEL 4.57 35-20 
FILTER FLTR TO PROP 8 Ч МҮ . 000 
$ ТЕК 12X RR 13X  COAS 14X PROP TO FLTR 9 t NY TRIM .000 
STAT XXXXXXXXX ХХХХ X +X.X ORB то TGT 10 је ALL Во. 1 
FLTR UPDATE 15 ХХХ Y Х.Х 3011 RUD 0.0 
COVAR REINIT 16Х EDIT OVRD + 2ЕБО Н ВІ А5 2 
RESID RATIO АСРТ REJ AUT INH РОВ I Н BIAS - 0 
RNG +ХХ.ХХ Х.Х XXX XXS 17Х 18Х 19Х RH | ВЕЕ -104 
к +ХХ.ХХ Х.Х XXX XXS 20Х 21Х 22Х 2510 ROLL REF L 61 
V/EL/Y 4X.XX Х.Х XXX XXS 23X 24X 25X Lu -180 - 100 CMD I 
H/AZ/X +Х.ХХ Х.Х XXX XXS RESUME 
GPS X +ХХХ. 42XS 43X 44Х 529 
X +ХХХ. . 
иа007587 527 tif ENTRY TRAJ 1 Display 
: 3041/ 1! ENTRY TRAJ 2 1 010/18: 40: 56 
REL МАУ Display fe D 000/ 00: TEN 
50--50 | | VasD 35р 25D 200 
T ү, 
l 1 BIAS (10 / ИИ 
T рғ 30.7 
2011/034/ ORBIT TGT 2 002/13:24:45 454 /180 
000/00:55:36 1 
MNVR ТІС AVX AVY = AVZ AVT 1 
10 2/14:20:21 + 9.1 - 0.5 «0.8 «9.1 4 
РВЕР МАТСН- 13 405! 
CONTROLS 
10 T2 TO T1 25 
LOAD 26 35 
COMPUTE T1 28 NY R. 010 
AX/DNRNG - 49.39 COMPUTE T2 29 NY TRIM .000 


ALL 50:22 
RUD 0.0 
ZERO H BIAS 2 


AY + 0.00 
А2/АН - 1.39 30 
АХ 14.96 


AY + 0.49 / / Вы. 

А2 - 0.50 254 ROLL REF L 64 
T2 TIG 2/15:42:26 ORBITER STATE -125 -190 CMD L 58 

AT + _82.1 02/ 8:32:38.114 RESUME 220 


АХ 0.00 Х +17213.696 


АҮ 0.00 


- 4052.545 


Y 

2 +13379. 393 
УХ +13.793848 
VY +16.958777 
VZ -12.548509 


usa007587 528.tif 


AZ 0.00 
21 BASE TIME 2/14:20:21 


3041/ / ENTRY TRAJ 3 1 Е 
| а D 000/00 :19:22 
ORBIT ТСТ Display ый 5380 M 
1 BIAS [10 4, / 
D REF 33.0 
404 13329 
BAZ - 8.9 
LO ENRGY 
30 3 INH 
NY .000 
NY TRIM .000 
AIL 12.3 
RUD 0.0 
ZERO H BIAS 2 
H BIAS - 42 
REF -224 
ROLL REF L 63 
CMD L 62 
1/0 RESET EXEC 
usa007587. 540.tif 
ENTRY TRAJ 3 Display 
2. SYSTEMS 2.13-72 


2.13 Guidance, Navigation, and Control (GNC) 


ENTRY TRAJ 4 1 010/18:45:41 
000/00:21:45 


LO ENRGY 
30 3 INH 


RUD 0.0 
ZERO H BIAS 2 
H BIAS - 40 
REF -287 

ROLL REF R 54 
CMO R50 


usa007587 541.tif 


ENTRY TRAJ 4 Display 


ENTRY TRAJ 5 1 010/18:47:29 
000/00:23:30 


1 BIAS (1 
D REF 23.1 


LO ENRGY 
30 3 INH 


- 0 
- 268 
L 42 
Е 43 


usa007587_542.tif 


ENTRY TRAJ 5 Display 


2.13-73 


USA007587 
Rev. A 


1 010/00:31:52 
000/00:00:00 


NOM 
SPD BK 66 
CMD 66 
L.018 
.000 NOSE LOT MEP 
RO.3 


10.0 


usa007587 531: 


VERT SIT 1 Display 


VERT SIT 2 1 010/00:31:52 
000/00:00:00 


315 210 


SPD BK 66 
CMD 66 


NY L.018 

.000 NOSE LO T MEP 
AIL в0.3 
10.0 


usa007587 532. 


VERT SIT 2 Display 


2. SYSTEMS 
2.13 Guidance, Navigation, and Control (GNC) 


USA007587 
Rev. A 


GNC Rules of Thumb 


e The PASS FDIR for the RGAs, AAs, and 
aerosurfaces terminates after the first 
failure. After the first failure, crew 
management of the selection filter is 
required. However, PASS has an RGA 
SMRD FDIR that will continue to deselect 
any power failed RGAs. For the BFS 
selection filter, crew management 15 
always required. Proper selection filter 
management is required for proper 
control. 


e For FCS channel management: 


— Never have more active channels on 
one GPC than another. 


If there are two failures on the same 
actuator, take the remaining FCS 
channels to OVERRIDE. 


Always maintain two good commands 
and one good feedback on each 
aerosurface. 
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— Delay 2 seconds between switch throws 
when moving FCS CHANNEL 
switches. Port bypass, or port pop, is a 
mechanical means to avoid force fights; 
feedback deselection is а software 
means to avoid a bad input into the 
selection filter. 


e For ascent, only the pilot's SBTC is active. 


To get manual throttles, the pilot must 
depress the TAKEOVER button and then 
match the commanded throttle setting. 
Manual rotational control is available only 
in PASS and must be both pitch and 
roll/yaw. 


For entry, both SBTCs are active. To get 
manual speed brake, the CDR or pilot 
must depress the TAKEOVER button. 
Manual rotational control is available in 
either pitch or bank in PASS and is 
required in both axes in BFS. 


For TACAN and ADTA management, talk 
to MCC before incorporating. 
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Description 


Тһе orbiter, unlike previous space vehicles, 
lands on a runway using a conventional type of 
landing system. Once the orbiter touches down, 
the crew deploys the drag chute, begins 
braking, and starts nose wheel steering 
operations. 


The orbiter drag chute, first used on the maiden 
flight of OV-105, improves the orbiter's decel- 
eration and eases the loads on the landing gear 
and brakes. 


Braking is accomplished by a sophisticated 
system that uses electrohydraulic disk brakes 
with an anti-skid system. Only the two main 
gear sets have braking capability, and each can 
be operated separately. 


Three primary steering options are available. 
The crew can use the rudder to assist steering 
while at higher ground speeds. By selecting 
nose wheel steering, the crew can use the 
rudder pedal assembly to operate a hydraulic 
steering actuator incorporated in the nose 
landing gear. By applying variable pressure to 
the brakes, the crew can steer the vehicle by a 
method called differential braking. 


Landing Gear 


The orbiter landing gear system is a tricycle 
configuration consisting of a nose landing gear 
and a left and right main landing gear. The 
nose landing gear is located in the lower 
forward fuselage, and the main landing gear is 
in the lower left and right wing area adjacent to 
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the midfuselage. Each landing gear includes a 
shock strut with two wheel and tire assemblies. 
Each main landing gear wheel is equipped with 
a brake assembly with anti-skid protection. 


Landing Gear Doors 


The nose landing gear has two doors, and each 
main gear has one door. When the crew com- 
mands gear deployment, the doors open auto- 
matically as the gear is dropped. This is accom- 
plished by the door extend/retract mechanism, 
which is actuated by the dropping gear. The 
nose landing gear doors have two door hooks 
that hold the doors closed, and the main gear 
doors have four door hooks. 


In addition, the doors have door-assist bungee 
assemblies. These assemblies exert additional 
force on the inside of the doors to assist in door 
deployment to overcome the aerodynamic forces 
acting against the doors and/or in case the 
pressure inside the wheel wells is less than the 
outside pressure. The nose landing gear bungee 
assist assemblies exert 2,000 pounds of force on 
the doors; the main landing gear bungee assist 
assemblies exert approximately 5,000 pounds of 
force on the doors over the first 2 inches of travel. 


The nose landing gear also contains a pyro boost 
system to further assure nose gear door and gear 
extension in case high aerodynamic forces on the 
nose gear door are present. This pyro system is 
fired each time the landing gear is deployed. 


Electrical 
power 
system 


Crew controls 


-- 


Power and control signals 


Nose landing Я | 
gear uplock апа | Man landing 
strut actuators | 9 


(Sys 1) 


Main landing Nose landing 
gear uplock and | gear steering 
strut actuators | ~ actuators 


System 2 


System 1 System 3 
Hydraulic system 
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Landing/Deceleration Interfaces 
Each of the landing gear doors has high- 
temperature reusable surface insulation tiles on 
the outer surface and a thermal barrier or door 


seal to protect the landing gear from the high 
temperatures encountered during reentry. 
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Gear Retraction 


During retraction, each gear is hydraulically 
rotated forward and up by ground support 
equipment until it engages an uplock hook for 
each gear in its respective wheel well. The 
uplock hook locks onto a roller on each strut. A 
mechanical linkage driven by each landing gear 
mechanically closes each landing gear door. 


The nose landing gear is retracted forward and 
up into the lower forward fuselage and is 
enclosed by two doors. The main landing gear 
is also retracted forward and up into the left 
and right lower wing area, and each is enclosed 
with a single door. The nose and main landing 
gear can be retracted only during ground 
operations. 


Gear Deployment 


When deployment of the landing gear is 
commanded by the crew, the uplock hook for 
each gear is unlocked by hydraulic system 1 
pressure. (See Section 2.1 for more information 
on orbiter hydraulic systems.) Once the hook is 
released from the roller on the strut, the gear is 
driven down and aft by springs, hydraulic 
actuators, aerodynamic forces, and gravity. A 
mechanical linkage released by each gear 
actuates the doors to the open position. The 
landing gear reaches the full-down and extended 
position within 10 seconds and are locked in the 
down position by spring-loaded downlock 
bungees. If hydraulic system 1 pressure is not 
available to release the uplock hook, a pyrotech- 
nic initiator at each landing gear uplock hook 
automatically releases the uplock hook on each 
gear 1 second after the flight crew has com- 


manded gear down. Main Landing Gear Deployed 
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STRUT ACTUATOR 
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DRAG BRACE ASSEMBLY 
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The landing gear is deployed at 300 + 100 feet Shock Struts 
and at a maximum of 312 knots equivalent air- 


speed (KEAS). The shock strut of each landing gear is the 


primary source of impact attenuation at 
landing. The struts have air/oil shock 
absorbers to control the тае of 
compression/extension and prevent damage to 
the vehicle by controlling load application rates 
and peak values. 


Each landing gear shock strut assembly is 
constructed of high-strength, stress- and corro- 
sion-resistant steel alloys, aluminum alloys, 


2. SYSTEMS 2.14-2 
2.14 Landing/ Deceleration System 


stainless steel, and aluminum bronze. Тһе 
shock strut is a pneumatic-hydraulic shock 
absorber containing gaseous nitrogen and 
hydraulic fluid. Because the shock strut is 
subjected to zero-g conditions during space 
flight, a floating piston separates the gaseous 
nitrogen from the hydraulic fluid to maintain 
absorption integrity. 


The nose landing gear shock strut has a 22-inch 
stroke. The maximum allowable derotation rate 
is approximately 9.9° per second or 11.5 feet per 
second, vertical sink rate. 


The main landing gear shock strut stroke is 16 
inches. The allowable main gear sink rate for a 
211,000-pound orbiter is 9.6 feet per second; for 
a 240,000-pound orbiter, it is 6 feet per second. 
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With a 20-knot crosswind, the maximum 
allowable gear sink rate for a 211,000-pound 
orbiter is 6 feet per second; for a 240,000-pound 
orbiter, it is approximately 5 feet per second. 
(Current maximum operational crosswind is 
limited to 15 knots.) 


Wheels and Tires 


Landing gear wheels are made in two halves 
from forged aluminum. The nose landing gear 
tires are 32 by 8.8 inches and have a normal 
nitrogen inflation pressure of 350 psi prior to 
launch. The maximum allowable load per nose 
landing gear tire is approximately 45,000 
pounds. Nose landing gear tires are rated for 
217 knots maximum landing speed. They may 
be reused once. 


The main landing gear tires are 44.5 by 21 inches 
and have 16 cord layers in a bias-ply design. 
They are normally inflated with nitrogen to a 
pressure of 370 pounds per square inch (psi). The 
maximum allowable load per main landing gear 
tire is 132,000 pounds. With a 60/40 percent tire 
load distribution, the maximum tire load on a 
strut is 220,000 pounds. The main gear tires are 
rated at 225 knots maximum ground speed and 
have a life of one landing. 
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Drag Chute 


The orbiter drag chute was designed to assist 
the deceleration system in safely stopping the 
vehicle on the runway at end of mission (EOM) 
and abort weights. Design requirements 
included the ability to stop a 248,000 Ib 
transoceanic abort landing (TAL) orbiter in 8,000 
feet with a 10 knot tailwind on a hot (103° F) 
day and maximum braking at 140 knots ground 
speed or one half runway remaining. The drag 
chute, housed at the base of the vertical 


stabilizer, is manually deployed by redundant 
commands from the commander (CDR) or pilot 
(PLT) prior to derotation. The drag chute is 
jettisoned at 60 (+20) knots ground speed to 
prevent damage to the main engine bells. The 
drag chute will be used on lake bed and 
concrete runways except with crosswinds 
greater than 15 knots or in the presence of main 
engine bell repositioning problems. The drag 
chute may be deployed without engine bell 


repositioning if  landing/rollout control 
problems exist. 
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Drag Chute Configuration 
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Nominal Sequence of Drag Chute Deployment, Inflation, and Jettison 


Pilot and Main Chutes 


When drag chute deployment is initiated, the 
door is blown off of the chute compartment by 
pyros and a mortar fires deploying a nine foot 
pilot chute. The pilot chute in turn extracts the 
40 foot, partially reefed conical main chute. The 
main chute is reefed to 40 percent of its total 
diameter for about 3.5 seconds to lessen the 
initial loads on the vehicle. The main chute 
trails the vehicle by 89.5 feet on a 41.5 foot riser. 


Drag Chute Controls 


The drag chute deployment and jettison 
pushbuttons, ARM 1(2), DPY 1(2), and JETT 1(2) 
are installed on either side of both the CDR's 
and PLT's heads-up displays (HUD). Activation 
of each lighted pushbutton initiates a signal 
through the primary and redundant paths 
simultaneously. The deployment sequence 
requires that both the ARM and DPY 
pushbuttons be activated simultaneously. The 
JETT pushbutton signal will only be effective 
when the ARM command has previously been 
initiated. Circuit breakers for the drag chute 
controls are located on panels O15 and O16. 
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Main Landing Gear Brakes 


Each of the orbiter's four main landing gear 
wheels has electrohydraulic disc brakes and an 
associated anti-skid system. The disc brake 
assembly consists of nine discs, five rotors, four 
stators, a backplate, and a pressure plate. The 
carbon-lined rotors are splined to the inside of 
the wheel and rotate with the wheel. The 
carbon-lined stators are splined to the outside of 
the axle assembly and do not rotate with the 
wheel. 


The brakes are controlled by the commander or 
pilot applying toe pressure to the upper portion 
of the rudder pedals; electrical signals produced 
by rudder pedal toe pressure control hydraulic 
servovalves at each wheel and allow hydraulic 
system pressure to actuate braking. Brakes 
cannot be applied until about 1.9 seconds after 
weight on the main gear has been sensed. The 
anti-skid system monitors wheel velocity and 
controls brake pressure to prevent wheel lock 
and tire skidding. The braking/anti-skid sys- 
tem is redundant in that it utilizes system 1 and 
2 hydraulic pressure as the active system with 
system 3 as standby, and it also utilizes all three 
main direct current (DC) electrical systems. 
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Landing Gear Hydraulics 


Brake System Hydraulic Power 


Each of the four main landing gear wheel brake 
assemblies is supplied with pressure from two 
different hydraulic systems. | Each brake 
hydraulic piston housing has two separate 
brake supply chambers. One chamber receives 
hydraulic source pressure from hydraulic sys- 
tem 1 and the other from hydraulic system 2. 
There are eight hydraulic pistons in each brake 
assembly. Four are manifolded together from 
hydraulic system 1 in a brake chamber. The 
remaining four pistons are manifolded together 
from hydraulic system 2. When the brakes are 


2. SYSTEMS 
2.14 Landing/ Deceleration System 


applied, the eight hydraulic pistons press the 
discs together, providing brake torque. 


When hydraulic system 1 or 2 source pressure 
drops below approximately 1,000 psi, switching 
valves provide automatic switching to 
hydraulic system 3. Loss of hydraulic system 1, 
2, or both would have no effect on braking 
capability, because standby system 3 would 
automatically replace either system. Loss of 
hydraulic system 3 and either 1 or 2 would 
cause the loss of half of the braking power on 
each wheel, and additional braking distance 
would be required. 
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The brake isolation valves in hydraulic systems 
1, 2, and 3 must be open to allow hydraulic 
pressure to the brakes. All three valves are 
automatically commanded open after weight on 
the main landing gear is sensed. The 3,000 psi 
hydraulic pressure is reduced by a regulator in 
each of the brake hydraulic systems to 2,000 


psig. 
Anti-Skid 


The anti-skid portion of the brake system 
provides optimum braking by preventing tire 
skid or wheel lockup and subsequent tire 
damage. 


Each main landing gear wheel has two speed 
sensors that supply wheel rotational velocity 
information to the skid control circuits in the 
brake/skid control boxes. The velocity of each 
wheel is continuously compared to the average 
wheel velocity of all four wheels. Whenever the 
wheel velocity of one wheel is 60 percent below 
the average velocity of the four wheels, skid 
control removes brake pressure from the slow 
wheel until the velocity of that wheel increases 
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hydraulic brake pressure to one of the brake 
chambers. The brake/skid control valves 
contain a brake coil and a skid coil. The brake 
coil allows hydraulic pressure to enter the brake 
chambers. The skid coil, when energized by the 
skid control circuit, provides reverse polarity to 
the brake coil, preventing the brake coil from 
allowing brake pressure to the brake chamber. 


Anti-skid control is automatically disabled 
below approximately 10 to 15 knots to prevent 
loss of braking for maneuvering and/or coming 
to a complete stop. 


The anti-skid system control circuits contain 
fault detection logic. The yellow ANTI SKID 
FAIL caution and warning light on panel F3 
will be illuminated if the anti-skid fault 
detection circuit detects an open circuit or short 
in a wheel speed sensor or control valve 
servocoil, or a failure in an anti-skid control 
circuit. A failure of these items will only 
deactivate the failed circuit, not total anti-skid 
control. If the BRAKES switches on panels O14, 
O15, and O16 are ON, and the ANTISKID 
switch on panel L2 is OFF, the ANTISKID FAIL 


to an acceptable range. caution and warning light will also Бе 
illuminated. 
The brake system contains eight brake/skid 
control valves. Each valve controls the 
Commander А 
pedals Pilot pedals 
Transducers (8) Transducers (8) 
Pover Brake/skid control boxes : 
; Аапа В - No-weight-on 
Jose control 4 circuits per box < 954) -main-gear 
Panel 015 ( ре ) control sensors 
BRAKES 
MN B - 
— Switch Switch «--- 
Hydraulic 4&— valve | Brake/skid control | Маме |-> Hydraulic 
power 4-4 Switch valves (8) Switch |p power 
— valve valve |4 — 
Рапе! 016 
BRAKES Brake chambers (8) 
MN C (2 per wheel) Panel L2 
To skid A Skip 
Wheel speed control 
sensors (8) | Main wheels (4) 
(2 per wheel) 


Brake/Skid Control System Overview 
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DRAG CHUTE 


ANTI SKID 
FAIL (У) 


ej. F3 


TRI 
RHC/PNL, 
ENABLE 


ANTI SKID FAIL Caution and Warning Light on Panel F3 


Panel L2 Panel 014 


BRAKES 


ANTISKID МЧА 


* Anti-skid fault detection circuits detect any of the 
following failures: 
- Qpen ог short in a wheel speed sensor circuit 


- On or short ina skid control servovalve circuit 


- Failure in an anti-skid control circuit 


Panel 015 
BRAKES 


5] fe] e] fel 


Panel 016 
BRAKES 


d 


** Applies only if brake 
power switches MN B, 
MN C or both are 
activated. 


Note: A failure will deactivate only the failed circuit and not total anti-skid control. 


555.cvs 


Anti-Skid Fail Light Status 


Temperature Control 


Insulation and electrical heaters are installed on 
the portions of the hydraulic systems that are 
not adequately thermally conditioned by the 
individual hydraulic circulation pump system 
because of stagnant hydraulic fluid areas. 


Redundant electrical heaters are installed on the 
main landing hydraulic flexible lines located on 
the back side of each main landing gear strut 
between the brake module and brakes. These 


heaters are required because the hydraulic fluid 
systems are dead-ended, and fluid cannot be 
circulated with the circulation pumps. The 
hydraulic system 1 lines to the nose landing gear 
are located in a tunnel between the crew 
compartment and forward fuselage. The passive 
thermal control systems are attached to the crew 
compartment, which leaves the hydraulic system 
1 lines to the nose landing gear exposed to 
environmental temperatures, thus requiring 
electrical heaters on the lines in the tunnel. 
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The HYDRAULICS BRAKE HEATER А, В, and С 
switches on panel R4 enable the heater circuits. 
The HYDRAULICS BRAKE HEATER switches A, 
B, and C provide electrical power from the 
corresponding main buses A, B, and C to the 
redundant heaters on the main landing gear 
flexible lines and the hydraulic system 1 lines in 
the tunnel between the crew compartment and 
forward fuselage leading to the nose landing 
gear. 


HYDRAULICS 
m BRAKE HEATER ——— 
A B с 


AUTO 


[ele 


(629) 


OFF 


LO 2 PREVALVE 
CTR 


OPEN 


AEN 
(©) 
(511 


CLOSE 
ІН? PREVALVE 
CTR 


CLOSEA 


D MPS/TVC 150 


cL r-FEEDLINE RLF 1501- 
D = [02 їн; 


(056) ' 
5145 2 515 3 
OPEN © 


322 зоо ЕН 


CLOSE A 


Е 
© 


LG/NWS HYD SYS 


AUTO 1/2 


| 1-1 
© el на" Ө 


HYDRAULICS BRAKE HEATER Switches on 
Panel R4 


Nose Wheel Steering 


The nose landing gear contains a hydraulic 
steering actuator that responds to electronic 
commands from the commander's or pilot's 
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rudder pedals. Two types of operation are 
available, GPC and caster. The GPC mode is 
supported by hydraulic systems 1 and 2 
through the selection of nose wheel steering 
(NWS) system 1 or 2. This provides redundant 
avionics modes regardless of hydraulic system 
support. NWS 1 or 2 will work with either 
hydraulic system 1 or 2. 


In the GPC modes, the flight control software uses 
accelerometer assembly feedback to modify 
commands from the rudder pedal transducer 
assemblies (RPTAs) to automatically counter 
hardovers or large lateral accelerations due to 
gear or tire malfunctions. If GPC 1 or 2, or FF1 or 
2 is inoperative, steering downmodes to caster if 
NWS 1 is selected. Similarly, the loss of GPC 3 or 
4, or FF3 or 4 will prevent the use of NWS 2 and 
cause a downmode. The loss of either NWS 
system will only cause a downmode to castor. 
The other NWS system must be selected if 
required. In caster, no positive control over the 
nose wheel position is available, and differential 
braking and rudder are used for directional control. 


A hydraulic servoactuator mounted on the nose 
strut permits orbiter NWS up to 9° left or right 
after system activation. Hydraulic systems 1 
and 2 provide redundant hydraulic pressure to 
either NWS 1 or 2. If NWS is not activated, or if 
hydraulic systems 1 and 2 fail, the NWS 
actuator acts as a nose wheel shimmy damper 
in the caster mode. 


NWS can only be enabled after certain pre- 
conditions are met. Among these preconditions 
are three major milestones: weight-on-wheels 
(WOW), pitch angle (Ө) less than 0°, and weight- 
on-nose-gear (WONG). There are three sensors 
on each main gear designed to sense when main 
gear touchdown (MGTD) occurs so that WOW 
can be set. One sensor is a proximity sensor and 
the other two are wheel speed sensors (one per 
tire). Once WOW is set, the speed brake is 
commanded full open, flat turn discrete is set, 
half gain RHC is enabled, and the HUD format 
downmodes. After WOW is set on one strut, 
brakes are also enabled. 
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| APU/HYD 1 


нэн нээ! 


ми 1 LDG ext rake isol 
CNTL АВ?" isol valve valve #2 
—— =: 


106 ext 
valve #2 


MNB FPC 2 
CNTL АВ1, 
BC1, BC2 


NWS HYD 
switching 
valve 


ММА FPC 1 
valve #2 


Note: Loss of any parameter within the dotted lines causes a loss of the 
associated NWS mode 
Loss of any paramenter within the dashed lines causes a loss of the 
associated HYD system for NWS 


*Manual (switch) control is lost for this valve; GPC capability still exists. 


О1-21 NWS Functional Drawing 


WONG can be set by either of two proximity 
sensors located on the nose gear. Once WONG 
is set (presupposing WOW is already set and 
the vehicle attitude (theta) is less than zero), the 
ground speed enable "flag" is set. This enables 
NWS and the I-loaded downward deflection of 
the elevons for tire load relief. As a backup to 
the WOW and WONG discretes, the crew 
nominally selects SRB SEP MAN/AUTO and 
presses the associated pushbutton. This will 
manually bypass the WOW/WONG discretes 
and set the ground speed enable "flag." Per the 
entry procedure, this should be accomplished 
just after nose gear touchdown. Taking the F7 
SEP Switch to MAN and pressing the associated 
pushbutton is an alternate method of manually 
backing up WOW/WONG. 


Operations 
Landing Gear 
Landing gear deployment is initiated when the 


commander (on panel F6) or pilot (on panel F8) 
depresses the guarded LANDING GEAR ARM 
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pushbutton and then the 


pushbutton. 


guarded DN 


NOTE 


Deploying the landing gear at equivalent 
airspeeds greater than 312 knots may 
result in high aerodynamic loads on the 
doors and interference with the normal 
opening sequence. 


HSI SELECT ————_| 
Г= ы RES т 


АРРВОАСН MLS 3 
@ror FLT CNTLR 
ALTM POWER 
1 ON 


OFF 


FLO884A04. PNL; 1 


1105.cnv 


Commander’s LANDING GEAR Controls 
on Panel F6 


Xx 


е Іс ә: LANDING GEAR =] Г HSI SELECT —— —1 


NOSE MODE m source — —34 
LEFT 22 RIGHT ENTRY 6Р5 1 
= 
= 


APPROACH MLS 3 


(B ROR «т CNTLR 
он ALTM РОМЕН 
ЯХХХХ| 1 ON 

(6) 


1106.cnv 


Pilot's LANDING GEAR Controls on Panel F8 


Depressing the ARM pushbutton energizes 
latching relays for the landing gear extend 
valves 1 and 2 in preparation for gear deploy. It 
also arms the nose and main landing gear 
pyrotechnic initiator controllers and illuminates 
the yellow light in the ARM pushbutton. This is 
normally performed by the pilot at approx- 
imately 2,000 feet above ground level (AGL). 


The DN pushbutton is then depressed. This 
energizes latching relays that open the 
hydraulic system 1 extend valve 1 and 
hydraulic system 2 landing gear extend valve 2. 
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Fluid in hydraulic system 1 flows to the landing 
gear uplock and strut actuators and the NWS 
switching valve. The green light in the DN 
pushbutton indicator is illuminated. Normally, 
the DN pushbutton is pressed at least 15 
seconds before touchdown at an altitude of 300 
feet + 100 feet and at an airspeed no greater 
than 312 KEAS. 


The proximity switches on the nose and main 
landing gear doors and struts provide electrical 
signals to control the LANDING GEAR NOSE, 
LEFT, and RIGHT indicators on panels F6 and 
F8. The output signals of the landing gear and 
door uplock switches drive the landing gear UP 
position indicators and the backup pyrotechnic 
release system. The output signals of the 
landing gear downlock switches drive the 
landing gear DN position indicators. The 
landing gear indicators are barberpole when the 
gear is in transit. 


The left and right main landing gear WOW 
switches produce output signals to the 
guidance, navigation, and control software to 
reconfigure the flight control system for landing 
and rollout gains. 


The two WONG signals, along with WOW and 
theta (pitch angle) less than 0°, allow the GNC 
software to issue a nose wheel steering enable 
signal. This signal is then sent to the steering 
control box to enable nose wheel steering. 


Six gear proximity switches are signal condi- 
tioned by the landing gear proximity sensor 
electronics box 1, located in avionics bay 1. Six 
additional gear proximity switches are signal 
conditioned by the landing gear proximity 
sensor electronics box 2, located in avionics bay 
2. All WOW proximity switches are redundant 
through two signal conditioners. 


Hydraulic system 1 source pressure is routed to 
the nose and main landing gear uplock 
actuators, which releases the nose and main 
landing gear and door uplock hooks. As the 
uplock hooks are released, the gear begins its 
deployment. During gear extension, a camming 
action opens the landing gear doors. The 
landing gear free falls into the extended posi- 
tion, assisted by the strut actuators and 
airstream in the deployment. The hydraulic 
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strut actuator incorporates a hydraulic fluid 
flowthrough orifice (snubber) to control the rate 
of landing gear extension and thereby prevent 
damage to the gear's downlock linkages. 


The BRAKE ISOL 1, 2, and 3 are opened via a 
GPC command sent after weight on the main 
gear is sensed. The landing gear isolation 
valves cannot be opened or closed with 
hydraulic pressures less than approximately 100 
psi. Hydraulic systems 1 and 2 share the 
braking duties, each providing hydraulic 
pressure to one-half of the braking pucks. 
Hydraulic system 3 provides the backup 
pressure for all the braking pucks. Landing 
gear extend valve 2 is located downstream of 
brake isolation valve 2. Since brake isolation 
valve 2 is opened after weight on wheels is 
present, hydraulic system 2 can only be used for 
redundant nose gear deploy if the brake isol 2 is 
manually opened early. 


The BRAKE ISOL VLV 2 and 3 switches on 
panel R4 positioned to CLOSE isolate the 
corresponding hydraulic system from the main 
landing gear brake control valves. The adjacent 
talkback indicator would indicate CL. When 
switches 2 and 3 are positioned to OPEN, the 
corresponding hydraulic system source 
pressure is available to the main landing gear 
brake control valves. The corresponding 
talkback indicator would indicate OP. Landing 
gear extend valve 2 is located downstream of 
brake isolation valve 2. This valve further 
isolates hydraulic system 2 supply pressure 
from the nose wheel steering and nose landing 
gear deploy actuators and is opened by a 
LANDING GEAR DN command. 


When the nose and main LANDING GEAR DN 
command is initiated, hydraulic system 1 
pressure is directed to the nose and main 
landing gear uplock hook actuators and strut 
actuators to actuate the mechanical uplock hook 
for each landing gear. This will allow the gear 
to be deployed and provide hydraulic system 1 
pressure to the nose wheel steering actuator. 
The landing gear/nose wheel steering hydraulic 
system switching valve will automatically select 
hydraulic system 2 supply pressure if system 1 
should fail, thereby providing redundant 
hydraulics for NWS actuation and nose gear 
deploy. 
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NOTE 


Hydraulic system 1 is the only hydraulic 
system for deploy of the main landing 
gear. 


If the hydraulic system fails to release the 
landing gear within 1 second after the DN 
pushbutton is depressed, the nose and left and 
right main landing gear uplock sensors 
(proximity switches) will provide inputs to the 
pyro initiator controllers (PICs) for initiation of 
the redundant NASA standard initiators (pyro 
system 1 and 2). They release the same uplock 
hooks as the hydraulic system. As mentioned 
earlier, the nose landing gear, in addition, has a 
PIC and redundant NASA standard initiators 
that initiate a pyrotechnic power thruster 2 
seconds after the DN pushbutton is depressed 
to assist gear deployment. This "nose gear pyro 
assist" pyro fires every time the gear аге 
deployed. 


The landing gear drag brace overcenter lock 
and spring-loaded bungee lock the nose and 
main landing gear in the down position. 


Two series valves, landing gear retract control 
valve 1 and 2, prevent hydraulic pressure from 
being directed to the retract side of the nose and 
main landing gear uplock hook actuators and 
strut actuators if the retract/circulation valve 
fails to open during nose and main landing gear 
deployment. 


During the landing sequence, GNC software 
commands the landing gear extend isolation 
valve OPEN at 0.8 Mach. The crew will verify 
the valve is open at 0.7 Mach, ARM the gear at 
2000 ft, and passing 300 feet, DEPLOY the gear. 
Brake ISO VLV 1, 2, and 3 are automatically 
opened after weight on the main gear is sensed 
with GPC commands via MDM ЕА1, FA2, and 
FA3, respectively. NWS is activated once 
weight is sensed on the nosewheel. The pilot 
verifies that the brake isolation valves are open 
for landing rollout. Should the gear or brake 
isolation valves fail to automatically OPEN, the 
pilot manually opens them using switches on 
panel R4. 
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BRAKE ISOL УТУ Switches and Talkbacks on 
Panel R4 


Ground Reset 


Landing gear reset is a post landing function, 
which will be performed by the crew. 


The LG ARM/DN RESET switch on panel A12 
positioned to RESET unlatches the relays that 
were latched during landing gear deployment 
by the LANDING GEAR ARM and DN 
pushbutton indicators. The primary function of 
this procedure is to remove power to the PIC 
circuits that are still charged as a backup 
landing gear deploy method. The RESET 
position also will extinguish the yellow light in 
the ARM pushbutton indicator and the green 
light in the DN pushbutton. 


Drag Chute 


During entry, at a velocity between 8000 to 3500 
fps, the main engine bells are repositioned 10° 
below the nominal to preclude damage during 
drag chute deployment. The crew cannot 
monitor the Бей repositioning but can 
determine that the system is enabled at item 19 
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LG ARM/DN RESET Switch on Panel A12 


on the SPEC 51 OVERRIDE display. The crew 
can inhibit the repositioning while in MM 301- 
304 by toggling item 19 in SPEC 51. Nominal 
EOM drag chute deployment will be initiated 
only if main engine bell repositioning is 
enabled. 


Although the drag chute may be deployed at 
speeds up to 230 KEAS, current EOM procedures 
call for its deployment at 195 KEAS with a 
crosswind component no greater than 15 knots. 
If the drag chute is deployed above 230 KEAS, 
the drag chute pivot pin is designed to fail, 
resulting in the chute being jettisoned. Approxi- 
mately one second after the CDR or PLT presses 
the ARM 1(2) and DPY 1(2) pushbuttons simul- 
taneously, the pilot chute deploys. Within 1 
second, the pilot chute extracts the main chute, 
which deploys to its 40 percent reefed diameter. 
After about 3.5 seconds of reefed deployment, 
two cutters sever the reefing ribbon allowing the 
main chute to inflate to its full 40-foot diameter. 
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WARNING 


Deployment of the drag chute between 135 
and 40 ft AGL can cause loss of control of 
Drag chute jettison must be 


the vehicle. 
initiated immediately to prevent loss of the 
vehicle and crew. 


At 60 (£20) KGS, the drag chute will be 
jettisoned. Below 40 KGS, if drag chute jettison 
has not been initiated, the chute will be retained 
until the orbiter has stopped to minimize 
damage to the main engine bells. 


Brake Controls 


The BRAKES MN A, MN B, and MN C switches 
are located on panels O14, O15, and O16. These 
switches allow electrical power to 
brake/anti-skid control boxes A and B. The 
ANTISKID switch located on panel L2 provides 
electrical power for enabling the anti-skid 
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portion of the braking system boxes A and B. 
The BRAKES MN A, MN B, and MN C switches 
are positioned to ON to supply electrical power 
to brake boxes A and B, and to OFF to remove 
electrical power. The ANTISKID switch is 
positioned to ON to enable the anti-skid system, 
and OFF to disable the system. 


When weight is sensed on the main landing 
gear, the brake/anti-skid boxes A and B are 
enabled and brake isolation valves 1, 2, and 3 
are opened, permitting the main landing gear 
brakes to become operational. 


BRAKES 
MN A 
ON 


[Ө] 


OFF 
BRAKES 
MN А 


[ —— OPERATIONAL INST 


BRAKES Switch on Panel O14 


[= OPERATIONAL INST ———4 
г 510 СОМА — MDM 
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BRAKES Switch on Panel О16 
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ANTISKID Switch on Panel L2 


The main landing gear brakes controlled by the 
commander's or pilot's brake pedals are located 
on the rudder pedal assemblies at the com- 
mander's and pilot's stations. Pressure on the 
toe of the adjustable brake/rudder pedals 
results in a command to the wheel braking 
system. 


Each brake pedal has four transducers. The left 
pedal transducer unit outputs four separate 
braking signals through the brake/skid control 
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boxes for braking control of the two left main 
wheels. The right pedal transducer unit does 
likewise for the two right main wheels. When 
the brake pedal is deflected, the transducers 
transmit electrical signals of 0 to 5 volts DC to 
the brake/anti-skid control boxes. 


If both right pedals are moved, the pedal with 
the greatest toe pressure becomes the control- 
ling pedal through electronic OR circuits. The 
electrical signal is proportional to the toe pres- 
sure. The electrical output energizes the main 
landing gear brake coils proportionately to 
brake pedal deflection, allowing the desired 
hydraulic pressure to be directed to the main 
landing gear brakes for braking action. The 
brake system bungee at each brake pedal 
provides the artificial braking feel to the 
crewmember. 


Nose Wheel Steering 
GPC Mode 


The NOSE WHEEL STEERING switch on panel L2 
positioned to NWS 1(2) enables the corresponding 
NWS (avionics) system. In addition to the NWS 
mode selections of the switch, the FLIGHT CNTLR 
POWER switch on panel F8 must be positioned to 
ON, and the flight control system ROLL/YAW CSS 
pushbutton on panel F2 or F4 must be depressed 
to enable the GPC for nose wheel steering. When 
either pushbutton is depressed, a white light 
illuminates the pushbutton. 
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NOSE WHEEL STEERING Switch 
on Panel 12 


When the commander or pilot makes an input 
to the rudder pedals in the NWS 1(2) mode, the 
rudder pedal command position is appropri- 
ately scaled within the GPC's software and 
transmitted to a summing network, along with 
lateral accelerometer inputs from within the 
flight control system. The accelerometer inputs 
are utilized to prevent any sudden orbiter 
lateral deviation. From this summing network, 
a nose wheel steering command is sent to 
comparison network, as well as to the steering 
servo system. 
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Steering position transducers on the nose wheel 
strut receive redundant electrical excitation 
from the steering position amplifier, which 
receives redundant electrical power from data 
display unit 2. 


Each of the three transducers transmits nose 
wheel position feedback to a redundancy 
management mid-value-select software. It then 
transmits a nose wheel position signal to the 
comparison network. The orbiter nose wheel 
commanded and actual positions are compared 
for position error and for rates to reduce any 


2. SYSTEMS 
2.14 Landing/ Deceleration System 


error. Absence of an error condition will allow 
nose wheel steering to be enabled after WOW, 
WONG, and theta less than 0? are sensed in the 
software. The enable signal permits hydraulic 
system 1(2) pressure to be applied to the nose 
wheel steering actuator from the NWS 
switching valve. If hydraulic system 1 is lost, 
hydraulic system 2 provides the pressure for 
nose wheel steering. If both systems' pressures 
drop below approximately 1,325 psi, the 
actuator remains in the caster mode and a 
failure is annunciated to the NWS FAIL C/W 
yellow light on panel F3. 


2.14-16 


USA007587 
Rev. A 


Landing/Deceleration System Summary Landing/Deceleration System Rules of 
Data Thumb 


e Landing gear should not be deployed at 
equivalent airspeeds greater than 312 
knots. 


e The orbiter has the capability of landing on 
a runway using a tricycle type of landing 
gear system. Once the orbiter touches 


down, the PIENE begins braking and +1 knot of touchdown speed corresponds 
steering operations. to +90 feet of distance. This is often 


rounded up to 100 feet for convenience. 
The landing gear consists of a nose landing P i 


gear and a left and right main landing 
gear. Each landing gear includes a shock 
strut with two wheel and tire assemblies. 


The nose wheels are co-rotating through a 
common axle, whereas the main gear 
wheels rotate independently. 


Each of the four main landing gear wheels 
has electrohydraulic brakes and an anti- 
skid system. Each gear wheel brake 
assembly is supplied with pressure from 
two different hydraulic systems. Systems 1 
and 2 are the primary hydraulic systems 
for brake pressure; system 3 can back up 
either or both systems. 


Redundant electrical heaters are installed 
on the main landing hydraulic flexible 
lines located on the back side of each main 
landing gear strut between the brake 
module and brakes. 


The orbiter nose wheel is steerable after 
nose wheel touchdown at landing. 


ANTI SKID FAIL and NWS FAIL caution 
and warning lights are located on panel F3. 


Landing/deceleration controls are located 
on panels F6, F8, R4, L2, F2, F4, A12, O14, 
O15, and O16. 
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— Mission station 
floodlight 
(fluorescent) 


Right seat/center 
console floodlight 
(incandescent) 


Right console 


floodlight 
Right glareshield сн (incandescent) 
floodlights 

(fluorescent) 


Left glareshield 
floodlights 
(fluorescent) 


E 


“Үгээ И 
floodlight 
(fluorescent) 


Left seat/center 
console floodlight 
(incandescent) 


Left console 


floodlight (fluorescent) Hight deck 


Payload station top view 
floodlight (fluorescent) 


Payload station 
floodlight 
(fluorescent) 


Left seat/center console 

floodlight (fluorescent) 

Left console floodlight 
(fluorescent) 

Left glareshield floodlights 
(fluorescent) 


Orbit station 
floodlight 
(fluorescent) 


Hight deck 
side view 
*Indicates an emergency light 


Floodlight Locations - 
Flight Deck Forward and Aft 


Description 


The lighting system provides both interior and 
exterior lighting. Interior lighting encompasses 
display and control visibility and general crew 
station and crew equipment operations. 
Exterior lighting provides illumination for 
payload bay door operations, EVA, remote 
manipulator system operations, stationkeeping, 
and docking. Interior lighting consists of 
floodlights, panel lights, instrument lights, 
numeric lights, and annunciator lights. Exterior 
lighting includes floodlights, spotlights, and 
docking lights. 
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Interior Lighting 


Interior floodlights provide general illumination 
throughout the crew cabin and allow the crew to 
function within the flight deck, middeck, airlock, 
tunnel adapter, and Spacehab (if installed). 
Circuit breakers, switches, and variable controls 
are used to operate the lights. Both fluorescent 
and incandescent lamps are used. 


Emergency lighting is provided by selected 
fixtures that are powered via a separate power 
input from an essential bus. Existing floodlights 
are used, but a separate input powers the lights. 


Dual fluorescent lamp fixtures provide lighting 
for the glareshield, mission station, and payload 
station floodlights. The mission station lighting 
is controlled by the MS LIGHTING FLOOD 
ON/OFF switch on panel R10; the adjacent 
rotary control DIM/BRT switch controls bright- 
ness. The payload station lighting is controlled 
by the PS FLOOD ON/OFF switch on panel L9, 
which also has an adjacent DIM/BRT rotary 
switch to control brightness. 


A single fluorescent lamp fixture with an integral 
off/variable-on is employed on each side of the 
commander’s and pilot’s side consoles and the 
orbit station. The commander’s glareshield light, 
which consists of left inboard (dual lamp) and 
left outboard (dual lamp), is controlled by the 
LIGHTING LEFT GLARESHIELD FLOOD 
BRIGHT, VAR, OFF switch and a DIM, BRT 
rotary control on panel O6. (The DIM, BRT 
rotary control operates in conjunction with the 
VAR position.) The pilot’s glareshield light 
functions the same as the commander's, except 
the controls (LIGHTING RIGHT GLARESHIELD 
FLOOD and DIM, BRT) are on panel O8. 


MS LIGHTING 


m — FL000 — — ——4 
252 
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CHANNEL 1 CHANNEL 2 


MS LIGHTING Controls on Panel R10 
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CDR LIGHTING Controls on Panel Об 


The commander’s side console light is controlled 
by an integral off/variable-on control switch on 
the fixture. The pilot’s side console light is 
controlled by the same type of control switch on 
the fixture. The orbit station light is controlled by 
the ORBIT STATION LIGHTING FLOOD 
ON/OFF switch and DIM, BRT rotary control on 
panel A6U. There are two seat/center console 
floodlights: one for the commander and one for 
the pilot. Each light has two incandescent bulbs: 
the left one illuminates the commander's lap or 
the center console, and the other illuminates the 
pilot’s lap or the center console. The commander 
or pilot can select either the lap or center console, 
but not both at once. The commander’s seat or 
console light is controlled by the LEFT SEAT/CTR 
CNSL FLOOD, SEAT/OFF/CTR CNSL switch and 
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the DIM, BRT rotary control on panel Об. The 
pilot’s seat or console light is controlled by the 
RIGHT SEAT/CTR CNSL FLOOD, 5ЕАТ/ОРЕ/ 
CTR CNSL switch and the DIM, BRT rotary 
control on panel O8. 
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Pilot’s Light Controls on Panel О8 
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Eight middeck ceiling floodlight fixtures are 
located behind a translucent polycarbonate 
material. They are the same fixtures as those at 
the orbit station and are individually controlled 
by MID DECK FLOODS ОМ/ОРЕ switches on 
panel MO13Q. The middeck panel МОТЗО is 
lighted by a small fluorescent lamp at each end 
of the recessed panel and is controlled by the 
MO13Q ГТС ON/OFF switch on the panel. 


The waste management compartment floodlight 
is also the same as the orbit station fixture and 
is controlled by the WASTE MANAGEMENT 
COMPARTMENT FLOOD ON/OFF switch on 
panel ML18F. 


The middeck sleep station bunks (if installed) 
use the same floodlights as the commander's 
and pilots flight deck consoles and are also 
controlled individually. 


The airlock floodlights are similar to those at the 
commander’s and pilot’s flight deck side 
consoles, except they are controlled by LIGHT- 
ING FLOOD switches on panel AW18A and an 
AIRLOCK 2 switch on panel MO13Q. 
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If the tunnel adapter is installed, the floodlights 
are similar to those at the commander’s and 
pilot’s side consoles. Tunnel adapter lights 2, 3, 
and 4 are controlled by individual ON/OFF 
switches on the tunnel adapter panel TW58T. 
Tunnel adapter light 1 is controlled by the 
TUNNEL ADAPTER 1 ON/OFF switch on panel 
MO13Q and the ON/OFF 1 switch on the tunnel 
adapter panel. 


The Spacehab (if installed) can accommodate 
different flight configurations, either a single 
module or a double module configuration. 
Each module has four overhead floodlights. 
The fixtures are single-lamp floodlights with an 
integral dimmer control on three. There is a 
main switch located on the monitor and control 
panel (MCP) at the entrance of the module that 
powers three floodlights per module. The 
emergency lighting system powers the remain- 
ing one floodlight per module in the event of a 
power failure. The Spacehab has a caution and 
warning (C&W) system that enables the master 
alarm light switch closure. The C&W 
luminaries are located on the MCP in the 
Spacehab. 
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AIRLOCK 2 and TUNNEL ADAPTER Lighting Controls on Panel MO13Q 
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LIGHTING 


FLOOD 


Airlock Flood LIGHTING Switches on Panel AW18A 
(Switches on Tunnel Adapter Panel TW58T аге in 
Identical Configuration) 


UPL INK 
NSP BLOCK 


OFF 
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EMERGENCY LIGHTING 
Switch on Panel C3 


The emergency floodlights for the crew module 
are controlled by EMERGENCY LIGHTING 
ON/OFF switches on either panel СЗ or MLI8F. 
The emergency lighting system is powering the 
floodlights when both panel switches are in the 
same position. When the emergency system is 
turned on, a relay is activated that configures the 
lights to full bright. Chem lights are available for 
crewmembers during minimum  floodlight 
operations. 


Panel Lighting 


Many flight deck instrument panels have 
integral lighting that illuminates the panel 
nomenclature and markings on the displays and 
controls. This illumination aids the flight crew 
in locating displays and controls while 
operating the orbiter. Panel lighting is trans- 
mitted from behind a panel overlay through the 
panel nomenclature, making it appear white- 
lighted. It is also transmitted to the edges of the 
displays and controls for general illumination. 
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2.15 Lighting System 


Тһе lighting source consists of small 
incandescent, grain-of-wheat lamps mounted 
between the metal panel face and the plastic 
panel overlay. The overlay has a layer of white 
paint and a layer of gray paint on the top 
surface. The panel nomenclature is formed by 
etching the letters and symbols into the gray 
paint, leaving the white layer underneath. 


On panel L4, panel lighting circuit breakers are 
found in the Q row: PANEL L/CTR, L OVHD; 
PANEL R OVHD, R; and PANEL MS, OS. The 
lighting circuit breakers are generally out for 
day launches. LIGHTING PANEL LEFT/ 
CENTER and LEFT OVERHEAD ОЕЕВКТ 
rotary switches are found on panel O6. 
LIGHTING PANEL КОНТ апа КОНТ 
OVERHEAD OFF/BRT rotary switches are 
located on panel O8. A LIGHTING PANEL 
ОРЕ/ВКТ rotary switch is located on panel R10. 
An ORBIT STATION LIGHTING PANEL 
OFF/BRT rotary switch is located on panel A6U. 
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Instrument Lighting 


The flight deck instruments have internal 
integral lighting that illuminates the face to 
enable the flight crew to read the displayed 
data. Lighting is provided by incandescent 
lamps located behind the face of the instru- 
ments. Prisms are used to distribute the light 
evenly over the face. Circuit breakers labeled 
INST OS, INST R, INST OVHD, and INST 
L/CTR are located in rows О and К on panel 14. 
LIGHTING INSTRUMENT  LEFI/CTR and 
OVERHEAD OFF/BRT rotary switches аге 
located on panel Об. A LIGHTING PANEL 
RIGHT INSTRUMENT OFF/BRT rotary switch 
is located on panel O8. An ORBIT STATION 
LIGHTING INSTRUMENT  OFE/BRT rotary 
switch is located on panel A6U. 
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Numeric Lighting 


Indicators on the flight deck use illuminated 
numeric (digital) readouts to display data. The 
illumination is provided by a single incandes- 
cent lamp in each segment of a digit. Seven 
segments are required to generate the numbers 
zero through nine. Each numeric indicator has 
a red light to indicate failures in the indicator 
and will be illuminated when any lamp in the 
indicator fails. The numeric (digital) indicators 
are EVENT TIME (panels F7 and A4), MISSION 
TIME (panels O3 and A4), RCS/OMS PRPLT 
QTY (panel ОЗ), and RANGE/ELEVATION and 
RANGE RATE/AZIMUTH (rendezvous radar) 
on panel A2. The LIGHTING NUMERIC OS 
circuit breaker is located in row Q on panel L4. 
A LIGHTING NUMERIC OFF/BRT rotary switch 
is located on panel O8, and an ORBIT STATION 
LIGHTING NUMERIC OFE/BRT rotary switch is 
located on panel A6U. The RMS (if installed) 
has numeric readouts on panel A8U. 
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Annunciator Lights 


Annunciators provide visual indications of 
vehicle and payload systems status. The 
annunciator lights are classified as emergency, 
warning, caution, and advisory. Emergency 
and warning annunciators are red, and cautions 
are yellow. Advisory annunciators may be 
white (status), green (normal configuration), 
yellow (alternate configuration), or blue (special 
applications). 


Annunciator lighting is provided by incandes- 
cent lamps that illuminate the lens area of the 
annunciators. Most annunciators are driven by 
ап annunciator control assembly, which 
controls the illumination of the lights during a 
“normal” or “test” input and also controls the 
brightness level. The caution and warning 
status lights on panel F7 and the GPC STATUS 
lights on panel О1 have separate electronic 
units for lighting control. Some annunciator 
lighting is provided by directly driven light 
emitting diodes (LEDs). 


Three different lens configurations exist for the 
pushbutton indicators and indicator lights. One 
configuration has illuminated nomenclature in 
the appropriate color on an opaque black 
background. The nomenclature cannot be seen 
until it is illuminated. Another configuration 
has non-illuminated white nomenclature on an 
opaque black background and a bar that 
illuminates in the appropriate color. The 
nomenclature in this configuration is always 
visible. The third configuration has a bar that 
illuminates on an opaque black background and 
no nomenclature on the lens, but nomenclature 
is available as part of the panel. 


The forward flight deck ANNUNCIATOR BUS 
SELECT ACA 1 and ACA 2/3 switches on panel 
O6 provide electrical power to enable the 
corresponding AC power supplies. (Section 2.8 
has details on the power system and associated 
terminology.) ACA 1 is enabled by positioning 
BUS SELECT ACA 1 to either the MN A or MN 
B position, and thus the annunciator lights 
associated with ACA 1. BUS SELECT ACA 1 
also provides electrical power to the 
ANNUNCIATOR INTENSITY BRIGHT, VAR 
switch and the LOW, MED rotary switch on 
panel O6, controlling the intensity of the 
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annunciator lights associated with ACA 1. 
ACAs 2 and 3 are enabled by positioning the 
BUS SELECT ACA 2/3 switch to either the MN B 
or MN C position, and thus the annunciator 
lights associated with ACAs 2 and 3. BUS 
SELECT ACA 2/3 also provides electrical power 
to the annunciator light INTENSITY BRIGHT, 
VAR switch on panel O6 and the LOW, MED 
rotary control on panel O6, thus controlling the 
intensity of the annunciator lights associated 
with ACAs 2 and 3. The OFF position of the 
BUS SELECT ACA 1 switch removes power 
from ACA 1, disabling the annunciator lights 
associated with it. The OFF position of the BUS 
SELECT ACA 2/3 switch removes power from 
АСАв 2 and 3, disabling the annunciator lights 
associated with them. 
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Тһе ANNUNCIATOR INTENSITY switch on 
panel O6 positioned to BRIGHT bypasses the 
INTENSITY LOW, MED rotary control. The 
ANNUNCIATOR INTENSITY switch positioned 
to VAR permits the INTENSITY LOW, MED 
rotary control to control annunciator light 
intensity. 


The ANNUNCIATOR LAMP TEST switch on 
panel O6 or O8 positioned to LEFT applies power 
to the ACA 1, 2, and 3 annunciator lamp test 
circuits, illuminating annunciator lights on 
panels F2 (MASTER ALARM), F6, L1 (SMOKE 
DETECTION), O1 (GPC STATUS), and М029), 
the left 20 C/W lights on panel F7, and the SM 
ALERT on panel F7. Positioning the LAMP TEST 
switches to RIGHT applies power to the ACA 1, 
2, and 3 annunciator lamp test circuits, 
illuminating the annunciator lights on panels C3, 
F4 (MASTER ALARM), F8, and M052] (MASTER 
ALARM), the right 20 C/W lights on panel F7, 
and the MAIN ENGINE STATUS lights on panel 
F7. 


The aft flight deck ANNUNCIATOR BUS 
SELECT switch on panel A6U provides electrical 
power to enable ACAs 4 and 5. ACAs 4 and 5 
are enabled by positioning BUS SELECT to either 
the MN B or MN С position, and thus the 
annunciator lights associated with ACAs 4 and 5. 
The BUS SELECT switch also provides electrical 
power to the annunciator light INTENSITY 
BRIGHT, VAR switch and the LOW, MED rotary 
control on panel A6U, thus controlling 
annunciator light intensity associated with ACAs 
4 and 5. The OFF position of the BUS SELECT 
switch removes power from ACAs 4 and 5, 
disabling the annunciator lights associated with 
them. 


The ANNUNCIATOR INTENSITY switch on 
panel A6U, when positioned ю BRIGHT, 
bypasses the INTENSITY LOW, MED rotary 
control on panel A6U. Positioned to VAR, it 
permits the INTENSITY LOW, MED rotary 
control to vary annunciator light intensity. 


The ANNUNCIATOR LAMP TEST switch on 
panel A6U, when positioned to LEFT, applies 
power to the ACA 4 and 5 annunciator lamp 
test circuits, illuminating the annunciator lights 
on panels A2 and A6U, the VIDEO INPUT 
pushbuttons on panel A7U, and columns 0 
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through 4 on panel R13U. Positioning the 
switch to RIGHT applies power to the ACA 4 
and 5 annunciator lamp test circuits, illuminat- 
ing the annunciator lights (MASTER ALARM) 
and VIDEO OUTPUT and ALC/GAMMA 
pushbuttons on panel A7U and columns 5 
through 9 on panel R13U. 
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Exterior Lighting 


The exterior floodlights improve visibility for 
the crew during payload bay door operations, 
EVA operations, RMS operations, 
stationkeeping, and docking. 


Metal halide lamps light the payload bay. These 
lamps are gas discharge arc tubes similar to 
mercury vapor lamps. 


After a floodlight is turned on, it takes 2 to 3 
minutes to reach full brightness. It is recom- 
mended by the manufacturer that payload bay 
floodlights remain powered for a minimum of 
10 minutes before being turned off. The only 
exception is if a floodlight fails to illuminate. If a 
light does not reach full brightness in 5 minutes, 
it should be unpowered. Also, when a light is 
turned off, it should not be repowered for 10 to 
16 minutes, depending on the amount of payload 
blocking of the light. These time constraints will 
help prolong floodlight life. 


The premature failure of the lamps on a 
previous flight may have been caused by not 
waiting the required time before repowering the 
lamps. It is better to leave the lamps powered 
until the task is finished than to try to save 
power by turning them off. 


Each lamp has a separate DC/DC power supply 
that produces the higher voltage required to 
operate the lamps. Power for the lamps is 
supplied by the mid power control assemblies, 
using 10-amp remote power controllers to 
control the lights. 


The power supplies for the metal halide lamps 
are mounted to the floodlight electronics 
assemblies, which are cooled by the Freon 
loops. The floodlight used for docking and the 
forward bulkhead floodlight use a cold plate 
cooled by the water loops. These two lights are 
present only оп OV-104, and have been removed 
from ОУ-103 and OV-105 due to issues with the 
water loop cold plate. 


The payload bay floodlights are controlled by 
switches on panel A7U. The panel contains 
PAYLOAD BAY FLOOD AFT, MID, and FWD 
sets of switches, with a STBD and PORT switch 
in each set. The DOCKING light switch is below 
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the payload bay flood controls on panel A7U; it 
has BRIGHT, DIM, and OFF settings. The RMS 
floodlight is controlled by RMS SPOTLIGHT 
STBD and PORT switches on panel А70. The 
DOCKING and FWD BHD switches are only active 
for OV-104, where the lights are still installed. The 
switches are physically present on OV-103 and -105, 
but do not do anything. 


PAYLOAD BAY FLOOD, DOCKING, and 
RMS Lighting Controls on Panel A7U 
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Lighting System Summary Data 


e Interior lighting consisting of floodlights, 
panel lights, instrument lights, numeric 
lights, and annunciator lights provides gen- 
eral illumination throughout the crew cabin. 


e Exterior floodlights and spotlights improve 
visibility for the flight crew during payload 
bay door operations, EVA operations, RMS 
operations, stationkeeping, and docking. 


e Emergency lighting is provided by separate 
fixtures powered by a separate power input 
from an essential bus. Emergency lighting is 
controlled by switches on panels C3 and 
MLI18F. 


e Switches controlling the lighting system are 
distributed over panels R10, L9, Об, O8, 
A6U, А70, МО1ЗО, ML18F, and AW18A. 


е Lighting system circuit breakers are located 
on panel LA. 


Lighting System Rules of Thumb 


* Power consumption of cockpit lighting can 
be as much as 1 to 2 kW with all lights on. 


* When payload bay floodlights are powered, 
they should be left on for a minimum of 10 
minutes. 


* When payload bay floodlights are turned off, 
they should remain unpowered for 10 to 16 
minutes prior to repowering. 


e If a payload bay floodlight does not reach 
full brightness within 5 minutes of being 
powered, it should be turned off. 
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2.16 MAIN PROPULSION SYSTEM 


(MPS) 


CONTENTS 


Description 

Space Shuttle Main Engines 
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Description 


The space shuttle main engines (SSMEs), 
assisted by two solid rocket motors during the 
initial phases of the ascent trajectory, provide 
vehicle acceleration from lift-off to main engine 
cutoff (MECO) at a predetermined velocity. 


The MPS has critical interfaces with the orbiter 
hydraulic system, electrical power system, 
master events controller, and data processing 
system. The hydraulic system supplies hydrau- 
lic pressure to operate the main engine valves 
and gimbal actuators. The electrical power 
system furnishes ac power to operate the main 
engine controllers and dc power to operate the 
valves and transducers in the propellant 
management and helium systems. The master 
events controller initiates firings of pyrotechnic 
devices to separate the SRBs from the external 
tank and the external tank from the orbiter. The 
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data processing system controls most of the 
MPS functions during ascent and entry. 


The MPS has three SSMEs, three SSME 
controllers, the ET, the orbiter MPS propellant 
management system and helium subsystem, 
four ascent thrust vector control units, and six 
SSME hydraulic TVC servoactuators. (The 
external tank is described in detail in Section 
1.3.) Most of the MPS is located in the aft 
fuselage beneath the vertical stabilizer. 
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Space Shuttle Main Engines (SSMEs) 


The three SSMEs are reusable, high-perform- 
ance, liquid propellant rocket engines with vari- 
able thrust. The engines use liquid hydrogen 
for fuel and cooling and liquid oxygen as an 
oxidizer. The propellant is carried in separate 
tanks within the external tank and is supplied to 
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the main engines under pressure. Using a 
staged combustion cycle, the propellants are 
partially burned at high pressure and relatively 
low temperature in two preburners, then com- 
pletely burned at high pressure and high tem- 
perature in the main combustion chamber. 


The engines are generally referred to as the 
center (engine 1), left (engine 2), and right 
(engine 3). Each engine is designed for 15,000 
seconds of operation over a life span of 30 
starts. Throughout the throttling range, the 
ratio of the liquid oxygen to liquid hydrogen 
mixture is 6:1. Each nozzle area ratio is 77.5:1. 
The engines are 14 feet long and 7.5 feet in 
diameter at the nozzle exit. Overall, a space 
shuttle main engine weighs approximately 
7,000 pounds. 


The main engines can be throttled over a range 
of 67 to 109 percent of their rated power level in 
1-percent increments. A value of 100 percent 
corresponds to a thrust level of 375,000 pounds 
at sea level and 470,000 pounds in a vacuum; 
104 percent corresponds to 393,800 pounds at 
sea level and 488,800 pounds іп a vacuum; 109 
percent corresponds to 417,300 pounds at sea 
level and 513,250 pounds in a vacuum. 


At sea level, flow separation in the nozzle 
reduces the engine throttling range, prohibiting 
operation of the engine at its minimum 
67-percent throttle setting. АП three main 
engines receive the same throttle command at 
the same time. Normally, these come 
automatically from the orbiter general-purpose 
computers (GPCs) through the engine 
controllers. During certain contingency 
situations, engine throttling may be controlled 
manually through the pilot's speedbrake/thrust 
controller. SSME throttling reduces vehicle 
loads during maximum aerodynamic pressure 
and limits vehicle acceleration to a maximum of 
3 g's during ascent. 


Hydraulically powered gimbal actuators allow 
each engine to be gimbaled in the pitch and yaw 
axes for thrust vector control. 


The SSME major components are the fuel and 
oxidizer turbopumps, preburners, a hot gas 
manifold, main combustion chamber, nozzle, 
oxidizer heat exchanger, and propellant valves. 
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Fuel Turbopumps 


Low-Pressure Fuel Turbopump 


The low-pressure fuel turbopump is an axial- 
flow pump driven by a two-stage axial flow 
turbine powered by gaseous hydrogen. | 
boosts liquid hydrogen pressure from 30 psia to 
276 psia and supplies the high-pressure fuel 
turbopump. During engine operation, this 
pressure increase allows the high-pressure fuel 
turbopump to operate at high speeds without 
cavitating. The low-pressure fuel turbopump 
operates at approximately 16,185 rpm, measures 
approximately 18 by 24 inches, and is flange- 
mounted to the SSME at the inlet to the low- 
pressure fuel duct. 
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High-Pressure Fuel Turbopump 


Тһе high-pressure fuel turbopump, a three- 
stage centrifugal pump driven by a two-stage, 
hot-gas turbine, boosts liquid hydrogen 
pressure from 276 psia to 6,515 psia. It operates 
at approximately 35,360 rpm. The discharge 
flow from the high-pressure turbopump is 
routed through the main fuel valve and then 
splits into three flow paths. One path is 
through the jacket of the main combustion 
chamber, where the hydrogen is used to cool 
the chamber walls, and then to the low-pressure 
fuel turbopump to drive its turbine. The second 
flow path, through the chamber coolant valve, 
supplies liquid hydrogen to the preburner 
combustion chambers and also cools the hot gas 
manifold. 


2.16-4 


The third hydrogen flow path is used to cool the 
engine nozzle. It then joins the second flow 
path from the chamber coolant valve. The high- 
pressure fuel turbopump is approximately 22 
by 44 inches and is flanged to the hot-gas 
manifold. 


Oxidizer Turbopumps 


Low-Pressure Oxidizer Turbopump 


The low-pressure oxidizer turbopump is an 
axial-flow pump driven by a six-stage turbine 
powered by liquid oxygen. It boosts the liquid 
oxygen pressure from 100 psia to 422 psia. The 
flow is supplied to the high-pressure oxidizer 
turbopump to permit it to operate at high 
speeds without cavitating. The low-pressure 
oxidizer turbopump operates at approximately 
5,150 rpm, measures approximately 18 by 18 
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inches, and is flange-mounted to the orbiter 
propellant ducting. 


High-Pressure Oxidizer Turbopump 


The high-pressure oxidizer turbopump consists 
of two single-stage centrifugal pumps (a main 
pump and a preburner pump) mounted on a 
common shaft and driven by a two-stage, hot- 
gas turbine. The main pump boosts liquid 
oxygen pressure from 422 psia to 4,300 psia 
while operating at approximately 28,120 rpm. 
Ihe high-pressure oxidizer turbopump 
discharge flow splits into several paths, one of 
which is routed to drive the low-pressure 
oxidizer turbopump turbine. Another path is 
routed through the main oxidizer valve and 
enters the main combustion chamber. Another 
small flow path is tapped off and sent to the 
oxidizer heat exchanger, where it is vaporized 
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and then used to pressurize the external tank. 
The final path enters the preburner boost pump 
to raise the liquid oxygen's pressure from 4,300 
psia to 7,420 psia at the inlet to the liquid 
oxygen preburner. The high-pressure oxidizer 
turbopump measures approximately 24 by 36 
inches. It is flanged to the hot-gas manifold. 


Bellows 


The low-pressure oxygen and low-pressure fuel 
turbopumps are mounted 180° apart on the 
engine. The lines from the low-pressure 
turbopumps to the high-pressure turbopumps 
contain flexible bellows that enable them to flex 
when loads are applied. This prevents them 
from cracking during engine operations. 


Helium Purge 


Because the high-pressure oxidizer turbopump 
turbine and pumps are mounted on a common 
shaft, mixing the fuel-rich hot gas in the turbine 
section and the liquid oxygen in the main pump 
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could create a hazard. To prevent this, the two 
sections are separated by a cavity that is 
continuously purged by the MPS engine helium 
supply during engine operation. Two seals, one 
located between the turbine section and the 
cavity, and the other between the pump section 
and cavity, minimize leakage into the cavity. 


Should this cavity experience a drop in helium 
pressure below opertating limits, the main 
engine controller will initiate an automatic 
engine shutdown, rather than risk the 
possibility of the propellants leaking through 
the seals, mixing in the cavity, and resulting in 
catastrophic engine shutdown. 
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WARNING 


Catastrophic shutdown may occur if low 
helium pressure occurs in the cavity while 
the operating limits are inhibited. The 
same is true if there is a rapid loss of 


helium pressure (e.g. both MPS helium 
isolation valves are closed). In either case, 
the propellants could possibly leak through 
the seals and mix in the cavity, resulting in 
catastrophic shutdown. 


Hot Gas Manifold 


The hot-gas manifold is the structural backbone 
of the engine. It supports the two preburners, 
the high-pressure turbopumps, and the main 
combustion chamber. Hot gas generated by the 
preburners, after driving the high-pressure 
turbopumps, passes through the  hot-gas 
manifold on the way to the main combustion 
chamber. 


Preburners 


The oxidizer and fuel preburners are welded to 
the hot-gas manifold. Liquid hydrogen and 
liquid oxygen from the high-pressure 
turbopumps enter the preburners and are 
mixed so that efficient combustion occurs. The 
preburners produce the fuel-rich hot gas that 
passes through the turbines to generate the 
power to operate the high-pressure 
turbopumps. The oxidizer preburner's outflow 
drives a turbine that is connected to the high- 
pressure oxidizer turbopump and the oxidizer 
preburner boost pump. Тһе fuel preburner's 
outflow drives a turbine connected to the high- 
pressure fuel turbopump. 


Main Combustion Chamber 


Each engine main combustion chamber receives 
fuel-rich hot gas from the fuel and oxidizer 
preburners. The high-pressure oxidizer turbo- 
pump supplies liquid oxygen to the combustion 
chamber where it is mixed with fuel-rich gas by 
the main injector. A small augmented spark 
igniter chamber is located in the center of the 
injector. The dual-redundant igniter is used 
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during the engine start sequence to initiate 
combustion. The igniters are turned off after 
approximately З seconds because Ње 
combustion process is self-sustaining. The main 
injector and dome assembly are welded to the 
hot-gas manifold. Тһе main combustion 
chamber is bolted to the hot-gas manifold. The 
combustion chamber, as well as the nozzle, is 
cooled by gaseous hydrogen flowing through 
coolant passages. 


Тһе nozzle assembly is bolted to the main 
combustion chamber. The nozzle is 113 inches 
long, with an exit plane of 94 inches. The 
physical dimension of the nozzle creates a 77.5:1 
expansion ratio. А support ring welded to the 
forward end of the nozzle is the engine attach 
point to the engine heat shield. Thermal 
protection is provided for the nozzles to protect 
them from the high heating rates experienced 
during the launch, ascent, on-orbit, and entry 
phases. The insulation consists of four layers of 
metallic batting covered with a metallic foil and 
screening. 


Oxidizer Heat Exchanger 


The oxidizer heat exchanger converts liquid 
oxygen to gaseous oxygen for tank pressur- 
ization and pogo suppression. Тһе heat 
exchanger receives its liquid oxygen from the 
high-pressure oxidizer turbopump discharge 
flow. 


Pogo Suppression System 


А pogo suppression system prevents the 
transmission of low-frequency flow oscillations 
into the high-pressure oxidizer turbopump and, 
ultimately, prevents main combustion chamber 
pressure (engine thrust) oscillation. Flow 
oscillations transmitted from the vehicle are 
suppressed by а partially filled gas 
accumulator, which is attached by flanges to the 
high-pressure oxidizer turbopump's inlet duct. 


The system consists of a 0.6-cubic-foot accum- 
ulator with an internal standpipe, helium pre- 
charge valve package, gaseous oxygen supply 
valve package, and four recirculation isolation 
valves. 
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During engine start, the accumulator is charged 
with helium 2.4 seconds after the start 
command to provide pogo protection until the 
engine heat exchanger is operational and 
gaseous oxygen is available. The accumulator is 
partially chilled by liquid oxygen during the 
engine chill-down operation. It fills to the 
overflow standpipe line inlet level, which is 
sufficient to preclude gas ingestion at engine 
start. During engine operation, the accumulator 
is charged with a continuous gaseous oxygen 
flow. 


The liquid level in the accumulator is controlled 
by an internal overflow standpipe, which is ori- 
ficed to regulate the gaseous oxygen overflow at 
varying engine power levels. The system is 
sized to provide sufficient supply of gaseous 
oxygen at the minimum flow rate and to permit 
sufficient gaseous oxygen overflow at the 
maximum pressure transient in the low-pres- 
sure oxidizer turbopump discharge duct. Un- 
der all other conditions, excess gaseous and liq- 
uid oxygen are recirculated to the low-pressure 
oxidizer turbopump inlet through the engine 
oxidizer bleed duct. 


The pogo accumulator is also pressurized with 
MPS helium at engine shutdown to provide a 
positive pressure at the high-pressure oxidizer 
turbopump inlet. Without this positve pressure, 
Ше sudden loss of acceleration that 
accompanies main engine cutoff (MECO) causes 
the turbine to cavitate before the blades have 
had a chance to spin down. The positive 
pressure provided by the accumulator prevents 
the turbine from cavitating, flying apart, and 
causing vehicle damage. 


CAUTION 


In situations where there is insufficient 
helium to charge the pogo accumulator 


(eg, a helium supply leak), a manual 
engine shutdown may be required pre- 
MECO, while the vehicle is still under 
acceleration. 
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Valves 


Each engine has five propellant valves (oxidizer 
preburner oxidizer, fuel preburner oxidizer, 
main oxidizer, main fuel, and chamber coolant) 
that are hydraulically actuated and controlled 
by electrical signals from the engine controller. 
They can be fully closed by using the MPS 
engine helium supply system as a backup 
actuation system. 


The turbine speeds of the high-pressure oxi- 
dizer turbopump and the high-pressure fuel 
turbopump depend on the position of the 
oxidizer and fuel preburner oxidizer valves. 
The engine controller uses the preburner 
oxidizer valves to control engine thrust by 
regulating the flow of liquid oxygen to the 
preburners. The oxidizer and fuel preburner 
oxidizer valves increase or decrease the liquid 
oxygen flow into the preburner, thereby 
increasing or decreasing preburner chamber 
pressure and, consequently, turbine speed. This 
directly affects liquid oxygen and gaseous 
hydrogen flow into the main combustion 
chamber which, in turn, can increase or 
decrease engine thrust. Тһе fuel preburner 
oxidizer valve is used to maintain a constant 6:1 
propellant mixture ratio. 


The main oxidizer valve controls liquid oxygen 
flow into the engine combustion chamber. The 
main fuel valve controls the total liquid 
hydrogen flow into the engine cooling circuit, 
the preburner supply lines, and the low- 
pressure fuel turbopump turbine. When the 
engine is operating, the main valves are fully 
open. 


A chamber coolant valve on each engine 
combustion chamber coolant bypass duct 
regulates the amount of gaseous hydrogen 
allowed to bypass the nozzle coolant loop to 
control engine temperature. The chamber 
coolant valve is 100 percent open before engine 
start, and at power levels between 100 and 109 
percent. For power levels between 67 and 100 
percent, the valve's position will range from 
68.3 to 100 percent open. 
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Propellant Dump 


After MECO, the main oxidizer valves in all 
three engines are opened to allow residual 
liquid oxygen to be dumped through the engine 
nozzles. Also after МЕСО, both liquid 
hydrogen fill/drain valves, as well as the fuel 
bleed valve, are opened to allow residual liquid 
hydrogen to drain over the left wing of the 
orbiter. 


Space Shuttle Main Engine Controllers 


The controller is a pressurized, thermally 
conditioned electronics package attached to the 
thrust chamber and nozzle coolant outlet 
manifolds on the low-pressure fuel turbopump 
side of the engine. Each controller contains two 
redundant digital computer units (DCUs), 
referred to as DCU A and DCU B. Normally, 
DCU A is in control, while DCU B electronics 
are active but not in control. Instructions to the 
engine control elements are updated 50 times 
per second (every 20 milliseconds). Engine 
reliability is enhanced by a dual-redundant 
system that allows normal DCU operation after 
the first failure and a fail-safe shutdown after a 
second failure. High-reliability electronic parts 
are used throughout the controller. The digital 
computer is programmable, allowing engine 
control equations and constants to be modified 
by changing the software. 
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The controller is packaged in а sealed, 
pressurized chassis and is cooled by convection 
heat transfer through pin fins as part of the 
main chassis. The electronics are distributed on 
functional modules with special thermal and 
vibration protection. 


Operating in conjunction with engine sensors, 
valves, actuators, and spark igniters, the 
controllers form a self-contained system for 
engine control, checkout, and monitoring. The 
controller provides engine flight readiness 
verification, engine start and shutdown 
sequencing, closed-loop thrust and propellant 
mixture ratio control, sensor excitation, valve 
actuator and spark igniter control signals, 
engine performance limit monitoring, and 
performance and maintenance data. The 
controller also provides onboard engine 
checkout, response to vehicle commands, and 
transmission of engine status. 
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Controller power is supplied by the three ac 
buses in a manner that protects their 
redundancy. Each computer unit within a 
controller receives its power from a different 
bus. The buses are distributed among the three 
controllers such that the loss of any two buses 
will result in the loss of only one engine. The 
digital computer units require all three phases 
of an ac bus to operate. There are two MPS 
ENGINE POWER switches on panel R2 for each 
engine controller (LEFT, CTR, RIGHT); the top 
switch is for DCU A, and the bottom switch is 
for DCU B. Cycling an MPS ENGINE POWER 
switch to OFF and back to ON will cause the 
affected digital computer unit to stop 
processing. 


Switches for engine controller heaters are found 
on panel R4, but these are nonfunctional. 
Heaters were once thought to be needed to keep 
the controllers thermally conditioned. This later 
turned out not to be the case. Since then, the 
heaters have not been installed. 
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Command and Data Flow 


Command Flow 


Each controller receives commands transmitted 
by the GPCs through its own engine interface 
unit (EIU), а _ specialized multiplexer/ 
demultiplexer (MDM) that interfaces with the 
GPCs and with the engine controller. When 
engine commands are received by the unit, the 
data are held in a buffer until the GPCs request 
data. The unit then sends the data to each GPC. 
Each engine interface unit is dedicated to one 
SSME and communicates only with the engine 
controller that controls its SSME. The three 
units have no interface with each other. 


The engine interface units are powered through 
the EIU switches on panel O17. If a unit loses 
power, its corresponding engine cannot receive 
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any throttle, shut down, or dump commands, 
and will not be able to communicate with the 
GPCs. As a result, the controller will maintain 
the last valid command until it is shut down 
manually via the MPS ENGINE POWER 
switches on panel R2. 


Each orbiter GPC, operating in a redundant set, 
issues engine commands from resident SSME 
subsystem operating programs to the EIUs for 
transmission to their corresponding engine 
controllers. Engine commands are output over 
the GPC's assigned flight-critical data bus (a 
total of four GPCs outputting over four flight- 
critical data buses). Therefore, each EIU will 
receive four commands. The nominal ascent 
configuration has GPCs 1, 2, 3, and 4 outputting 
on flight-critical data buses 5, 6, 7, and 8, respec- 
tively. Each data bus is connected to one 
multiplexer interface adapter in each EIU. 
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The EIU checks the received engine commands 
for transmission errors. If there are none, the 
EIU passes the validated engine commands on 
to the controller interface assemblies (CIAs), 
which output the validated engine commands 
to the engine controller. An engine command 
that does not pass validation is not sent to the 
CIA. Instead, it is dead-ended in the 
multiplexer interface adapter (MIA). 
Commands that come through MIA 1 and MIA 
2 are sent to CIA 1 and CIA 2, respectively. 
Commands that come to MIA 3 and MIA 4 pass 
through CIA 3 data-select logic. This logic 
outputs the command that arrives at the 
interface first. The other command is dead- 
ended. The selected command is output 
through CIA 3. In this manner, the EIU reduces 
the four input commands to three output 
commands. 


The engine controller vehicle interface 
electronics receive the three engine commands, 
check for transmission errors (hardware 
validation), and send controller hardware- 
validated engine commands to the controller 
channel A and B electronics. Normally, channel 
A electronics are in control, with channel B 
electronics active but not in control. If channel 
A fails, channel В will assume control. КЕ 
channel B subsequently fails, the engine 
controller will shut the engine down. If two or 
three commands pass voting, the engine 
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controller will issue its own commands to 
accomplish the function requested by the 
orbiter GPCs. If command voting fails, and two 
or more commands fail, the engine controller 
will maintain the last command that passed 
voting. 


Whenever the controller does not receive two of 
three valid inputs, it creates a command path 
failure. The GPCs will issue an "MPS CMD 
C(L,R)” fault message and light the yellow 
MAIN ENGINE STATUS light on panel F7. 


Ihe backup flight system (BFS) computer, 
GPC 5, contains SSME hardware interface 
program applications software. When the four 
primary GPCs are in control, GPC 5 does по 
commanding. When GPC 5 is in control, the 
BFS sends commands to, and requests data 
from, the engine interface unit. The BFS, when 
engaged, allows GPC 5 to command flight- 
critical buses 5, 6, 7, and 8 for main engine 
control through the 55МЕ hardware interface 
program, which performs the same main engine 
command functions as the SSME subsystem 
operating program. Ihe command flow 
through the engine interface units and engine 
controllers is the same when GPC 5 is engaged 
as for the four-GPC redundant set. 


Data Flow 


The engine controller provides all the main 
engine data to the GPCs. Sensors in the engine 
supply pressures, temperatures, flow rates, 
turbopump speeds, valve positions, and engine 
servovalve actuator positions to the engine 
controller. The engine controller assembles 
these data into a vehicle data table and adds 
other status data. The vehicle data tables 
output via channels A and B to the vehicle 
interface electronics for transmission to the 
engine interface units. Тһе vehicle interface 
electronics output data over both the primary 
and secondary data paths. 


The vehicle data table is sent by the controller to 
the engine interface unit. There are only two 
data paths versus three command paths 
between the engine controller and the engine 
interface unit. The data path that interfaces 
with CIA 1 is called primary data. Primary 
data consist of the first 32 words of the 55МЕ 
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vehicle data table. Secondary data is the path 
that interfaces with CIA 2. Secondary data 
consist of the first six words of the vehicle data 
table. Primary and secondary data are held in 
buffers until the GPCs send a primary and 
secondary data request command to the engine 
interface units. Primary data are output only 
through MIA 1 on each engine interface unit. 
Secondary data are output only through MIA 4 
on each engine interface unit. 


At T minus zero, the orbiter GPCs request both 
primary and secondary data from each engine 
interface unit. For no failures, only primary 
data are looked at. If there is a loss of primary 
data (which can occur between the engine 
controller channel A electronics and the SSME 
subsystem operating procedure), only the 
secondary data are transmitted to the GPCs. 


Loss of both primary and secondary data creates 
a data path failure. This causes the GPCs to issue 
an “MPS DATA C(L,R)” fault message and light 
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the appropriate yellow MAIN ENGINE STATUS 
light on panel F7 


NOTE 


Unlike powered flight, loss of either 
primary or secondary data prelaunch will 
result in a data path failure. This will 
either inhibit engine ignition or result in a 
launch pad shutdown of all three main 
engines. 


Electric Lockup 


An electric lockup occurs when the engine 
controller loses data from either the LH2 
flowmeters or the main combustion chamber 
pressure sensors, both of which are needed to 
set the proper mixture ratio. Because the 
mixture ratio can no longer be controlled, the 
controller will actively hold the engine valves at 
their last commanded position. This puts the 
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engine in “lockup”; that is, it will no longer 
throttle. The engine will still shutdown when 
commanded. However, shutdown will now 
occur from a different throttle setting than 
normal. A manual shutdown of the engine pre- 
MECO may be required (see section 6.8). 


Controller Software 


The two primary engine controller programs 
are the flight operational program and the test 
operational program. The flight operational 
program is a real-time, process-control program 
that processes inputs from engine sensors, 
controls the operation of the engine 
servovalves, actuators, solenoids, and spark 
igniters, accepts and processes vehicle 
commands, provides and transmits data to the 
vehicle, and provides checkout and monitoring 
capabilities. 


The test operational program supports engine 
testing prior to launch. Functionally, it is 
similar to the flight operational program but 
differs in implementation. The programs are 
modular and are defined as computer program 
components. Each consists of a data base 
organized into tables. During application of the 
computer program components, the programs 
perform data processing for failure detection 
and status of the vehicle. As system operation 
progresses through ап operating phase, 
combinations of control functions are operative 
at different times. These combinations within a 
phase are defined as operating modes. 


The checkout phase initiates active control 
monitoring or checkout. The standby mode in 
this phase puts the controller on pause while 
active control sequence operations are in 
process. Monitoring functions that do not affect 
engine hardware status are continually active 
during this mode. Such functions include 
processing vehicle commands, updating engine 
status, and self-testing the controller. During 
checkout, data and instructions can be loaded 
into the engine controller's computer memory, 
permitting updates to the software and data as 
necessary to proceed with engine-firing or 
checkout operations. Component checkout is 
also performed during this mode. 


The start preparation phase consists of system 
purges and propellant conditioning to prepare 
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for engine start. The first, purge sequence 1 
mode, includes oxidizer system and 
intermediate seal purge operation. This is 
followed by purge sequence 2 mode, which 
includes fuel system purge operation and the 
continuation of purges initiated during purge 
sequence 1. Purge sequence 3 mode includes 
propellant recirculation (bleed valve operation). 
Purge sequence 4 mode includes fuel system 
purges and indicates that the engine is ready to 
enter the start phase. The engine-ready mode 
occurs when proper engine thermal conditions 
for start have been attained, and other criteria 
for start have been satisfied, including a 
continuation of the purge sequence 4 mode. 


The start phase covers engine ignition opera- 
tions and scheduled open-loop operation of the 
propellant valves. The start initiation mode in- 
cludes all functions before ignition confirm and 
the closing of the thrust control loop. During 
thrust buildup, the main combustion chamber 
pressure is monitored to verify that closed-loop 
sequencing is in progress. 


Main stage is automatically entered upon suc- 
cessful completion of the start phase. Mixture 
ratio control and thrust control are active. 


The shutdown phase covers operations to reduce 
main combustion chamber pressure and drive all 
valves closed to effect full engine shutdown. 


The post-shutdown phase starts at completion 
of SSME shutdown. During the terminate se- 
quence, all propellant valves are closed, and all 
solenoid and torque motor valves are de- 
energized. 


Propellant Management System (PMS) 


Liquid hydrogen and liquid oxygen pass from 
the ET to the PMS, which consists of manifolds, 
distribution lines, and valves. It also contains 
lines needed to transport gases from the engines 
to the external tank for pressurization. 


During prelaunch activities, this subsystem is 
used to load liquid oxygen and liquid hydrogen 
into the external tank. After MECO, the PMS is 
used to complete a liquid oxygen and liquid 
hydrogen dump and vacuum inerting. It is also 
used for manifold repressurization during entry. 
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Feedline Disconnect Valves 


Two disconnect valves are found in each feedline 
where the orbiter meets the external tank. One is 
on the orbiter side of the manifold, and the other 
is on the external tank side. All four are closed 
automatically prior to external tank separation. 
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Fill/Drain Valves 


Two (outboard and inboard) 8-inch-diameter 
liquid oxygen and liquid hydrogen fill/drain 
valves are connected in series. They are used to 
load the external tank before launch to perform 
the post-MECO MPS propellant dump. The 
valves can be manually controlled by the 
PROPELLANT  FILL/DRAIN 102, 1Н2 
OUTBD, INBD switches on panel R4. Each 
switch has OPEN, GND, and CLOSE positions 


Relief Valves 


Each 8-inch liquid hydrogen and liquid oxygen 
manifold has a 1-inch-diameter line that is routed 
to a feedline relief isolation valve and then to a 
feedline relief valve. When the feedline relief 
isolation valve is opened automatically after 
MECO, the corresponding manifold can relieve 
excessive pressure overboard through its relief 
valve. The relief isolation valves can also be 
manually controlled by the MAIN PROPULSION 
SYSTEM FEEDLINE RLF ISOL LO2 and LH2 
switches on panel R4. The switches have OPEN, 
GPC, and CLOSE positions. 


Backup Liquid Hydrogen Dump Valves 


The backup liquid hydrogen dump line 
connects the feedline manifold to an overboard 
port above the left wing of the orbiter. The line, 
designed primarily for a post-MECO liquid 
hydrogen dump during a return-to-launch site 
(RTLS) abort, is also used to vent the liquid 
hydrogen manifold after a nominal MECO. 
Since liquid hydrogen evaporates quickly, this 
vent is used to prevent pressure buildup in the 
hydrogen manifold from repeatedly cycling the 
relief valve before the propellant dump begins. 
It is also used for two post-dump vacuum 
inerts, nominally. 


Flow through the lines is controlled by two 
valves in series, which are normally com- 
manded by the GPCs. However, during OPS 1, 
they can be manually controlled by the MPS 
PRPLT DUMP BACKUP LH2 УТУ switch on 
panel R2, which has OPEN, GPC, and CLOSE 
positions. In an RTLS abort dump, liquid hy- 
drogen is dumped overboard through a port at 
the outer aft fuselage's left side between the 
OMS/RCS system pod and the upper surface of 
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the wing. These valves are also known as the 
LH2 RTLS Dump valves. 


Topping Valve 


This valve controls the flow of liquid hydrogen 
through the tank topping manifold, which is 
used for prelaunch liquid hydrogen tank topping 
and thermal conditioning. During thermal 
conditioning, propellants flow through the 
engine components to cool them for engine start. 


Liquid hydrogen is loaded through the 
outboard fill/ drain valve, circulates through the 
topping valve to the engines for thermal 
conditioning, and is pumped into the external 
tank for tank topping. (The part of the topping 
recirculation line that goes to the external tank 
is not shown on the pocket checklist schematic.) 
The topping valve can be controlled indirectly 
by the crew via the LH2 inboard FILL DRAIN 
switch on panel КА. When this switch is taken 
to OPEN, both the LH2 inboard fill/drain and 
topping valves open. 


There is no topping valve for liquid oxygen. 
Since liquid oxygen is harmless in the 
atmosphere, it is not circulated back to the 
external tank during thermal conditioning. 
Rather, it is dumped overboard through the 
engine liquid oxygen bleed valves and out the 
overboard bleed valve. 


Liquid Hydrogen 
and Liquid Oxygen Bleed Valves 


Three liquid hydrogen bleed valves, one in each 
engine, connect the engine internal liquid 
hydrogen line to the topping valve manifold. 
The valves are used to route liquid hydrogen 
through the engines during prelaunch thermal 
conditioning and to dump the liquid hydrogen 
trapped in the engines post-MECO. 


There are also three liquid oxygen bleed valves 
that are not shown on the pocket checklist 
schematic. They connect the engine internal 
liquid oxygen lines to an overboard port and are 
used only during prelaunch thermal conditioning. 
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Prevalves 


The prevalve in each of the three 12-inch 
feedlines to each engine isolates liquid oxygen 
and liquid hydrogen from each engine or 
permits liquid oxygen and liquid hydrogen to 
flow to each engine. Most of the prevalve 
functions are automatic, but they can also be 
controlled by the LO2 and LH2 PREVALVE, 
LEFT, CTR, RIGHT switches on panel R4. Each 
switch has OPEN, GPC, and CLOSE positions. 


Ullage Pressure System 


Ullage refers to the space in each tank not 
occupied by propellants. The ullage pressure 
system consists of the sensors, lines, and valves 
needed to route gaseous propellants from the 
three main engines and supply them to the 
external tank to maintain propellant tank 
pressure during engine operation. 


There are two external tank pressurization 
manifolds, one for gaseous oxygen and one for 
gaseous hydrogen. During prelaunch, the 
manifolds are used to supply ground support 
pressurization of the ET using helium routed 
through the Т-0 umbilical. Self-sealing quick 
disconnects are provided at the T-0 umbilical 
for separation at lift-off. 


Each manifold contains three  0.63-inch- 
diameter pressurization lines, one from each 
engine. The three lines join in a common 
manifold prior to entering the ET. 


In each SSME, a small portion of liquid oxygen 
from the high-pressure oxidizer turbopump main 
pump is diverted into the engine's oxidizer heat 
exchanger. The heat generated by the engine's 
high-pressure oxidizer turbopump converts the 
liquid oxygen into gaseous oxygen and directs it 
through a check valve to a fixed orifice and then 
to the ET. During ascent, the liquid oxygen tank 
pressure is maintained between 20 and 25 psig 
by the fixed orifice. If the tank pressure is greater 
than 30 psig, it is relieved through the liquid 
oxygen tank's vent and relief valve. 


In each SSME, a small portion of gaseous 
hydrogen from the low-pressure fuel turbo- 
pump is directed through two check valves, two 
orifices, and a flow control valve before 
entering the ET. During ascent, the liquid 
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hydrogen tank pressure is maintained between 
32 and 34 psia using both a variable and a fixed 
orifice in each SSME supply system. The active 
flow control valve is controlled by one of three 
liquid hydrogen pressure transducers. When 
the tank pressure decreases below 32 psia, the 
valve opens; when the tank pressure increases 
to 33 psia, the valve closes. If the tank pressure 
exceeds 35 psia, the pressure is relieved through 
the liquid hydrogen tank's vent and relief valve. 
If the pressure falls below 28 psia, the MPS LH2 
ULL PRESS switch on panel R2 is positioned 
from AUTO to OPEN, causing all three flow 
control valves to go to full open. 


The three liquid hydrogen and three liquid 
oxygen ullage pressures are displayed on the 
BFS GNC SYS SUMM 1 display (ULL P). 


The SSME/ET liquid hydrogen pressurization 
system also contains a line that is used to vent 
the liquid hydrogen pressurization manifold 
during post-MECO inerting. It is controlled by 
the Н» PRESS LINE VENT switch on panel R4. 
This valve is normally closed. Post-MECO, 
however, this valve is opened for about one 
minute to allow for vacuum inerting. The GND 
position allows the launch processing system to 
control the valve during ground operations. 


MPS PRPLT DUMP BACKUP LH2VLV 
Switch and LH2ULLAGE PRESS Switch 
on Panel R2 
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Manifold Repress Valves 


The liquid hydrogen and liquid oxygen 
manifold repress valves route helium from the 
MPS helium system into the feedline manifolds. 
The helium pressure is used to expel 
propellants during the MPS propellant dump 
and to repressurize the propellant lines during 
entry. The valves can be controlled manually 
using the MAIN PROPULSION SYSTEM 
MANF PRESS switches on panel R4. 


MPS Valve Types 


All the valves in the MPS are either electrically 
or pneumatically operated. Pneumatic valves 
are used where large loads are encountered, 
such as in the control of liquid propellant flows. 
Electrical valves are used for lighter loads, such 
as the control of gaseous propellant flows. 


The pneumatically actuated valves are divided 
into two types: type 1, which requires 
pneumatic pressure to open and close the valve, 
and type 2, which is spring-loaded to one 
position and requires pneumatic pressure to 
move to the other position. 


Each type 1 valve actuator is equipped with two 
electrically actuated solenoid valves, which 
control helium pressure to an "open" or "close" 
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port on the actuator. Energizing the solenoid 
valve on the open port allows helium pressure to 
open the pneumatic valve. Energizing the 
solenoid on the close port allows helium pressure 
to close the pneumatic valve. Removing power 
from a solenoid valve removes helium pressure 
from the corresponding port of the pneumatic 
actuator and allows the helium pressure trapped 
in that side of the actuator to vent into the aft 
compartment. Removing power from both 
solenoids allows the pneumatic valve to remain 
in the last commanded position. This is known 
as a bi-stable valve. 


Type 1 valves are used for the liquid oxygen 
and liquid hydrogen feedline 17-inch umbilical 
disconnect valves, the liquid oxygen and liquid 
hydrogen prevalves, the liquid hydrogen and 
liquid oxygen inboard and outboard fill and 
drain valves, and the liquid hydrogen 4-inch 
recirculation disconnect valves. 


Each type 2 valve is a single electrically 
actuated solenoid valve that controls helium 
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pressure to either an open or a close port on the 
actuator. Removing power from the solenoid 
valve removes helium pressure from the 
corresponding port of the pneumatic actuator 
and allows helium pressure trapped in that side 
of the actuator to vent overboard. Spring force 
takes over and drives the valve to the opposite 
position. If the spring force drives the valve to 
the open position, the valve is referred to as a 
normally open (NO) valve. If the spring force 
drives the valve to a closed position, the valve is 
referred to as a normally closed (NC) valve. 


Type 2 pneumatic valves are used for the liquid 
hydrogen RTLS inboard dump valve (NC), the 
liquid hydrogen RTLS outboard dump valve 
(NC), the liquid hydrogen feedline relief shutoff 
valve (NO), the liquid oxygen feedline relief 
shutoff valve (NO), the three liquid hydrogen 
engine recirculation valves (NC), the two liquid 
oxygen pogo recirculation valves (NO), the 
liquid hydrogen topping valve (NC), the liquid 
hydrogen high-point bleed valve (NC), and the 
liquid oxygen overboard bleed valve (NO). 


Propellant 
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Overboard Overboard Overboard 


vent vent 
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(de-energized) 


Open 
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© Control switch 
in open position 
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pressure 
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Propellant Management Subsystem Typical Type 1 Pneumatically 
Actuated Propellant Valve 
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Propellant Management Subsystem Typical Type 2 
Pneumatically Actuated Propellant Valve Helium System 


The electrically actuated solenoid valves are 
spring-loaded to one position and move to the 
other position when electrical power is applied. 
These valves also are referred to as either 
normally open or normally closed, depending 
on their position in the de-energized state. 
Electrically actuated solenoid valves are the 
gaseous hydrogen pressurization line vent 
valve (NC), the three gaseous hydrogen pres- 
surization flow control valves (NO), and the 
three gaseous oxygen pressurization flow 
control valves (NO). 


Helium System 


The MPS helium system consists of seven 4.7- 
cubic-foot helium supply tanks, three 17.3- 
cubic-foot helium supply tanks, and associated 
regulators, check valves, distribution lines, and 
control valves. 


The MPS helium system is used for in-flight 
purges within the engines, and it provides pres- 


supplies pressure to actuate the pneumatically 
operated valves within the propellant 
management system. During entry, the 
remaining helium is used for the entry purge 
and repressurization. (Unlike the orbital 
maneuvering system and reaction control 
system, the MPS does not use helium to 
pressurize propellant tanks.) 


The MPS helium supply system is divided into 
four separate subsystems, one for each of the 
three main engines and a fourth pneumatic 
system to operate the propellant valves. 


All the valves in the helium subsystem are 
spring-loaded to one position and electrically 
actuated to the other position. The supply tank 
isolation valves are spring-loaded to the closed 
position and pneumatically actuated to the open 
position. Valve position is controlled via electri- 
cal signals either generated by the onboard 
GPCs or manually by the flight crew. All the 
valves can be controlled automatically by the 


sure for actuating engine valves during GPCs, and the flight crew can control some of 
emergency pneumatic shutdowns. It also е valves. 
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Main Propulsion System Helium Schematic from the Ascent Pocket Checklist 
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Helium Tanks 


The tanks are composite structures consisting of 
a titanium liner with a fiberglass structural 
overwrap. The large tanks are 40.3 inches in 
diameter and have a dry weight of 272 pounds. 
The smaller tanks are 26 inches in diameter and 
have a dry weight of 73 pounds. The tanks are 
serviced before lift-off to a pressure of 4,100 to 
4,500 psi. 


Four of the 4.7-cubic-foot helium supply tanks 
are located in the aft fuselage, and the other 
three are located below the payload bay in the 
midfuselage. The three 17.3-cubic-foot helium 
supply tanks are also located below the payload 
bay in the midfuselage. 


Each of the larger supply tanks is plumbed to 
two of the smaller supply tanks (one in the mid- 
body, the other in the aft body), forming three 
clusters of three tanks. Each set of tanks nor- 
mally provides helium to only one engine and is 
commonly referred to as left, center, or right 
engine helium, depending on the engine 
serviced. Each set normally provides helium to 
its designated engine for in-flight purges and 
provides pressure for actuating engine valves 
during emergency pneumatic shutdown. 


The remaining 4.7-cubic-foot helium tank is 
referred to as the pneumatic helium supply 
tank. It provides pressure to actuate all the 
pneumatically operated valves in the propellant 
management subsystem. 


The helium pressure of the pneumatic, left, 
center, and right supply systems сап ђе 
monitored on the MPS PRESS HELIUM, PNEU, 
L, C, R meters on panel F7 by positioning the 
switch below the meters to TANK. Left, center, 
right, and pneumatic tank pressures can be 
monitored on the BFS GNC SYS SUMM 1 
display (MPS L, C, R HE TK P, and MPS PNEU 
HE P TK). 


Helium Isolation Valves 


Eight helium supply tank isolation valves 
grouped in pairs control the flow of helium 
from the tanks. One pair of valves is connected 
to each of the three tank clusters, and one pair is 
connected to the pneumatic supply tank. In the 
engine helium supply tank system, each pair of 
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isolation valves is connected in parallel, with 
each valve in the pair controlling helium flow 
through one leg of a dual-redundant helium 
supply circuit. Each helium supply circuit 
contains two check valves, a filter, an isolation 
valve, a regulator, and a relief valve. 


The two isolation valves connected to the 
pneumatic supply tanks are also connected in 
parallel. The rest of the pneumatic supply sys- 
tem consists of a filter, the two isolation valves, a 
regulator, a relief valve, and a single check valve. 


Each engine helium supply isolation valve can be 
individually controlled by the He ISOLATION A 
LEFT, CTR, RIGHT, and He ISOLATION B 
LEFT, CTR, RIGHT switches on panel R2. The 
switches have OPEN, GPC, and CLOSE 
positions. The two pneumatic helium supply 
isolation valves are controlled by а single 
PNEUMATICS He ISOL switch on panel R2, 
which also has OPEN, GPC, and CLOSE 
positions. 
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Helium Pressure Regulators 


Each engine helium supply tank has two 
pressure regulators operating in parallel. Each 
regulator controls pressure to within 730 to 
785 psia in one leg of a dual-redundant helium 
supply circuit and is capable of providing all 
the helium needed by the main engines. 


216-22 


The pressure regulator for the pneumatic 
helium supply system is not redundant and 
regulates outlet pressure between 715 to 
770 psig. Downstream of the pneumatic 
regulator are the liquid hydrogen manifold 
pressure regulator and the liquid oxygen 
manifold pressure regulator. These regulators 
are used only during MPS propellant dumps 
and manifold pressurization. Both regulators 
are set to provide outlet pressure between 20 
and 25 psig. Flow through the regulators is 
controlled by the appropriate set of two 
normally closed manifold pressurization valves. 


Downstream of each pressure regulator, with 
the exception of the two manifold 
repressurization regulators, is a relief valve. 
The valve protects the downstream helium 
distribution lines from overpressurization if the 
associated regulator fails fully open. The two 
relief valves in each engine helium supply are 
set to relieve at 790 to 850 psig and reseat at 
785 psig. 


The regulated pressure of the left, center, right, 
and pneumatic systems can be monitored on the 
BFS GNC SYS SUMM 1 display (MPS L, СЕ 
REG P and МР5 PNEU ВЕС). They are also 
displayed on the OMS/MPS MEDS Display. 
The MEDS display, however, only displays the 
REG A pressure, unlike BF5 GNC SYS SUMM 1 
which displays both REG A and REG B. 


Pneumatic Left Engine Helium 
Crossover Valve 


The crossover valve between the pneumatic and 
left engine helium systems serves as a backup 
for the nonredundant pneumatic pressure 
regulator system. In the event of a pneumatic 
helium regulator failure or a leak in the 
pneumatic helium system, the left engine 
helium system can provide regulated helium 
through the crossover valve to the pneumatic 
helium distribution system. The PNEUMATICS 
L ENG He XOVR switch is on panel R2. 
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Helium Interconnect Valves 


During ascent, the four helium supply systems 
operate independently. However, during 
dumps and purges, and in the event of system 
leaks, one system can draw helium from 
another via the helium interconnect valves. 


Each engine helium supply has two 
interconnect valves associated with it: one 
designated “IN OPEN”; the other, “OUT 
OPEN”. Check valves ensure that helium flows 
in only one direction through the IN OPEN and 
OUT OPEN interconnect valves. Through the 
IN OPEN valve, helium is drawn into the 
affected engine from a pressure line common to 
all three engine helium systems. This common 
line is normally fed by the pneumatic helium 
supply. The OUT OPEN valve, on the other 
hand, routes the affected engine’s helium to the 
common line where other engines can access it. 


Each pair of interconnect valves is controlled by 
a single switch on panel R2. Each Не 
INTERCONNECT LEFT, CTR, RIGHT switch 
has three positions: IN OPEN, GPC, and OUT 
OPEN. With the switch in GPC, the 
interconnect valves are controlled by the orbiter 
software. 
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Manifold Pressurization 


Manifold pressurization valves, located 
downstream of the pneumatic helium pressure 
regulator, are used to control the flow of helium 
to the LO2 propellant manifold for a nominal 
LO2 propellant dump and for LH2 and LO2 
manifold repressurization on entry. There are 
four of these valves grouped in pairs. One pair 
controls helium pressure to the liquid oxygen 
propellant manifold, and the other pair controls 
helium pressure to the liquid hydrogen 
propellant manifold. 


There are additional regulators just past the 
manifold repress valves that regulate the 
pneumatic helium from the normally regulated 
pressure of 750 psi to a lower, usable pressure. 
The LH2 manifolds are pressurized to 17 to 
30 psig and the LO2 manifolds are pressurized 
to 20 to 25 psig during the MPS dump and entry 
manifold repressurization. 


Additionally, on the LH2 propellant manifold, 
there are manifold pressurization valves that 
open during propellant dumps to remove LH2 
from the manifold while executing return-to- 
launch-site (RTLS) or transoceanic abort landing 
(TAL) profiles. 


Pneumatic Control Assemblies 


There is one pneumatic control assembly on 
each SSME. The assembly is essentially a 
manifold pressurized by one of the engine 
helium supply systems and contains solenoid 
valves to control and direct pressure to perform 
various essential functions. The valves are 
energized by discrete ON/OFF commands from 
the output electronics of the SSME controller. 
Functions controlled by the pneumatic control 
assembly include the high-pressure oxidizer 
turbopump intermediate seal cavity and 
preburner oxidizer dome purge, pogo system 
postcharge, and pneumatic shutdown. 


MPS Hydraulic Systems 


Hydraulic System Operation 


The three orbiter hydraulic systems (see 
section 2.1 for more on the hydraulic system) 
supply hydraulic pressure to each SSME to 
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actuate the engine valves and to provide thrust 
vector control. The three hydraulic supply 
systems are distributed to the thrust vector 
control (ТУС) valves. These valves are con- 
trolled by HYDRAULICS MPS/TVC ISOL VLV 
switches (one for each of the three hydraulic 
systems) on panel R4. A valve is opened by 
positioning its switch to OPEN. The talkback 
indicator above each switch indicates OP when 
the valve is open and CL when it is closed. 


When the three MPS/TVC ISOL valves are 
opened, hydraulic pressure is applied to the five 
hydraulically actuated engine valves (the main 
fuel valve, the main oxidizer valve, the fuel 
preburner oxidizer valve, the oxidizer 
preburner oxidizer valve, and the chamber 
coolant valve). АП hydraulically actuated 
engine valves receive hydraulic pressure from 
the same hydraulic system: HYD SYS 1 for the 
center engine valves; HYD SYS 2 for the left 
engine valves; HYD SYS 3 for the right engine 
valves. Each engine valve actuator is controlled 
by dual-redundant signals: channel A/engine 
servovalve 1 and channel B/engine servovalve 
2 from that engine's controller electronics. In 
the event of a hydraulic system failure, all the 
hydraulically actuated engine valves can be 
blown closed with helium pressure from the 
affected engine’s helium supply. 


Hydraulic Lockup 


Hydraulic lockup occurs when the engine 
controller senses any one of the five 
hydraulically actuated engine valves outside 
the limits of where it is expected to be. This 
may be due to a hydraulic system failure or a 
failure of the engine valve itself. Consequently, 
the controller will hydraulically isolate all five 
engine valves at their last position. This 
minimizes, but does not prevent, the valve from 
drifting. The valve could still deviate further 
and possibly cause a loss of performance and 
even an engine failure. The engine is now in 
“lockup”; that is, the engine will no longer to 
throttle. The engine will still shutdown when 
commanded. However, shutdown will now 
occur from a different throttle setting than 
normal. А manual shutdown of the engine pre- 
MECO may be required (see section 6.8). 
Whether commanded or manual, a shutdown 
will be done pneumatically via engine helium. 
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Thrust Vector Control 


The three MPS/TVC ISOL valves on panel К4 
must also be opened to supply hydraulic 
pressure to the six main engine TVC actuators. 
There are two servoactuators per SSME: one for 
yaw and one for pitch. Each actuator is 
fastened to the orbiter thrust structure and to 
the powerheads of the three SSMEs. 


Two actuators per engine provide attitude 
control and trajectory shaping by gimbaling 
both the SSMEs and SRBs during first-stage and 
the SSMEs alone during second-stage. Each 
SSME servoactuator receives hydraulic pressure 
from two of the three orbiter hydraulic systems; 
one system is the primary system, and the other 
is a standby secondary system. Each 
servoactuator has its own hydraulic switching 
valve. The switching valve receives hydraulic 
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pressure from two of the three orbiter hydraulic 
systems and provides a single source to the 
actuator. 


Center SSME 
engine 1 


Yaw actuators 


Pitch 
actuators 


Left SSME 
engine 2 


Main Engine Gimbal Actuators 


Normally, the primary hydraulic supply is 
directed to the actuator. However, if the 
primary system were to fail and lose hydraulic 
pressure, the switching valve would 
automatically switch over to the secondary 
system, and the actuator would continue to 
function. 


The following tables summarizes the hydraulic 
system assignments for the SSME actuators: 


Pitch Yaw 
РЕГ | SEC | PRI | SEC 
Hyd Hyd Hyd Hyd 
аах 42 00157027 
Left Hyd Hyd Hyd Hyd 
Sys 2 Sys1 Sys1 Sys 2 
Hyd Hyd Hyd Hyd 
Right | 553 | Sys2 | Sys2 | Sys3 


Detailed information about ascent thrust vector 
control is provided in section 2.13. 


Hydraulic System Isolation On Orbit 


The HYDRAULICS МР5/ТУС ISOL УГУ SYS 1, 
SYS 2, and SYS 3 switches on panel R4 are 
positioned to CLOSE during on-orbit operations 
to protect against hydraulic leaks downstream 
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of the isolation valves. In addition, there is no 
requirement to gimbal the main engines from 
the stow position. During on-orbit operations 
when the MPS/TVC ISOL valves are closed, the 
hydraulic pressure supply and return lines 
within each MPS/TVC component are inter- 
connected to enable hydraulic fluid to circulate 
for thermal conditioning. 


Malfunction Detection 


There are three separate means of detecting 
malfunctions within the MPS: SSME redlines, 
the hardware caution and warning (C/W) 
system, and the software C/W system. 


SSME Redlines 


The SSME controller processes numerous 
engine operating parameters, four of which are 
critical to safely operating the engine. The 
controller closely monitors these four 
parameters to see whether they remain within 
the main engine limits (or "redlines") specified 
by the Flight Rules: 


e The high-pressure fuel turbopump's 
discharge temperature not to exceed 
1860° R. 


e The high-pressure oxidizer turbopump's 
discharge temperature not to exceed 
1660° R or fall below 720° R. 


е The high-pressure oxidizer turbopump's 
intermediate seal purge pressure not to 
fall below 159 psia. 


e During steady state operation, the main 
combustion chamber's pressure not to 
fall more than 200 psia (400 psia, during 
throttling) below the reference chamber 
pressure. 


е The high-pressure fuel and oxidizer 
turbopumps’ vibration levels not to exceed 
8 g and 4 g, respectively. 


Assuming main engine limits are enabled, a 
redline violation sensed by the controller will 
cause the controller to automatically shut down 
the engine to guard against uncontained SSME 
damage. Certain situations, however, call to 
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have main engine limits inhibited. In this case, 
the engine will continue to run, though at 
increased risk of undergoing a catastrophic 
shutdown. 


WARNING 


An engine failure with limits inhibited will 
probably result in vehicle damage. Further, 


as the controller will probably be damaged 
as well, the engine failure would go 
unrecognized by the GPCs. 


The flight crew can control whether main 
engine limits are enabled or inhibited via the 
MAIN ENGINE LIMIT SHUT DN switch on 
panel C3. The switch has three positions: 


ENABLE -- Enables main engine limits. 


AUTO -- Enables main engine limits. 
However, immediately after one engine has 
shut down (either automatically ог 
manually), main engine limits are inhibited 
on the remaining engines. 


INHIBIT -- Inhibits main engine limits. 


SSME Status Lights 


The MAIN ENGINE STATUS lights (CTR, 
LEFT, RIGHT) on panel F7 each have a red half 
and an amber half. 


The red half illuminates for an engine in 
shutdown or post-shutdown phase or for an 
engine that is running with a redline violation. 


The amber half illuminates for an engine 
experiencing any of the following failures: 


® Command path failure 
e Hydraulic lockup 

e Electric lockup 

e Data path failure 


Hardware C/W 


Operating limits have been given to certain 
pieces of MPS hardware: 
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• MPS He КЕСР (Reg А only) not to exceed 
810 psia or fall below 680 psia. 


e MPS He TK P not to fall below 1150 psia. 


e MPS ІН2 МАМЕ P not to exceed 
65 psia. 


e MPS [02 МАМЕ P not to exceed 
249 psia. 


A violation of any of those limits will illuminate 
the red MPS light on the C/W matrix, found on 
panel F7. (Violations in the He TK P and 
LH2/LO2 MANF P will also illuminate the 
Backup C/W Alarm light.). 


Software C/W 


For certain MPS out-of-limit or fault conditions 
detected by the GPCs, the following fault 
messages appear on the PASS and/or BFS DPS 
displays. 


Generated by both PASS and BFS: 


е "SSME FAIL C(L,R)" - Premature main 
engine shutdown. 


® "MPS CMD C(LR)' - Command path 
failure occurs, when the main engine 
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controller does not receive 2/3 valid 
inputs from the GPCs. (message from 
PASS only pre-engage). 


е "MPS HYD C(L,R)" - Hydraulic lockup 
occurs, whenever the main engine 
controller senses any one of the five 
engine valves out of position. 


e "MPS ELEC C(L,R)" - Electric lockup 
occurs, whenever the main engine 
controller loses all Pc data or all fuel flow 
rate data from the engine. 


e "МР5 DATA C(L,R)" - Data path failure 
occurs, due to loss of both primary and 
secondary data from the main engine 
controller to the GPCs. 


e "ET SEP INH" - Message triggered by 
either vehicle rates greater than 0.7 
deg/sec роѕ- МЕСО ог  feedline 
disconnect failures. (During RTLS, also 
triggered when either angle of attack or 
sideslip angle exceeds limits post-MECO.) 


- NOM/ATO - ЕТ separation 
inhibited until the flight crew 
either nulls the rates or manually 
initiates ET separation. 
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- TAL -- ET separation inhibited 
only for excessive rates (which 
flight crew must null). Otherwise, 
automatic separation after a brief 
delay to allow for venting. 


- RTLS -- Automatic ET separation 
after a brief delay to allow for 
venting. 


Generated by PASS only: 


e "ET SEP MAN" - The ET SEPARATION 
switch on panel C3 is іп dilemma. 
Function has defaulted to MANUAL. ET 
separation must be manually initiated by 
the flight crew. 


e "ET SEP AUTO" - Like “ET SEP MAN”, 
this also means that the ET SEPARATION 
switch on panel C3 is in dilemma. 
However, function has defaulted to AUTO 
instead, and ET separation will occur as 
expected. 


е "ME SHDN SW C(L,R)" - MAIN ENGINE 
SHUT DOWN pushbutton on panel C3 is 
in dilemma and no longer functional. 


Generated by BFS only: 


e "MPS H2 OUT P C(L,R)" - SSME СН; 
outlet pressure less than 1050 psia 
(indication of а premature engine 
shutdown). 


e "MPS HE P C(L,R)" - 
+ MPS He TK P is less than 1150 psi. 


+ Change in He TK P is greater than 20 
psi over 3 seconds (indication of a 
helium leak). 


+ MPS He REG P is less than 679 psi or 
more than 810 psi. 


е "MPS LH2/O2 ULL" - ET LH2 шаре 
pressure is less than 28 psig or greater 
than 48.9 psig; ET LO2 ullage pressure is 
0 or more than 29.0 psig. 


• "MPS O2 OUT T C(LR)' - SSME GO» 


outlet temperature less than 125? F 
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(indication of a 
shutdown). 


premature engine 


® "МР5 PNEU P ACUM" - МР5 pneumatic 
accumulator pressure is less than 700 psia. 


® "МР5 PNEU P REG" - МР5 pneumatic 
regulator pressure is less than 700 psia or 
greater than 810 psia. 


® "MPS PNEU P TK" - MPS pneumatic tank 
pressure is less than 3800 psia. 


These failures have messages that аге 
annunciated in OPS 1 and 6. Also, the BFS does 
all processing of the MPS helium and ullage 
pressure systems. 


In OPS 3, the MPS parameters on the ВЕ5 SYS 
SUMM 1 will be blanked, except for helium REG 
A and B pressure. 


In OPS 2, there is no software caution and 
warning for the MPS. Therefore, if either 
manifold pressure (LO2 or LH2) violates limits 
while on orbit, the only indication the crew will 
see is hardware caution and warning (MPS light 
and master alarm.) There will be no message on 
the DPS display. 


Operations 


Prelaunch 


At T minus 5 hours 50 minutes, the launch 
processing system initiates the SSME liquid 
hydrogen chill-down sequence in preparation 
for liquid hydrogen loading. At T minus 
5 hours 15 minutes, the fast-fill portion of the 
liquid oxygen and liquid hydrogen loading 
sequence begins, and the liquid hydrogen 
recirculation pumps аге started shortly 
thereafter. At T minus 3 hours 45 seconds, the 
fast fill of the liquid hydrogen tank to 98 
percent is complete, and a slow topping off 
process that stabilizes to 100 percent begins. At 
T minus 3 hours 30 minutes, the liquid oxygen 
fast fill is complete. At T minus 3 hours 15 
minutes, liquid hydrogen replenishment begins, 
and liquid oxygen replenishment begins at T 
minus 3 hours 10 minutes. 


During prelaunch, the pneumatic helium supply 
provides pressure to operate the liquid oxygen 
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and hydrogen prevalves and outboard апа 
inboard fill and drain valves. The three engine 
helium supply systems are used to provide anti- 
icing purges. 


The MPS helium tanks are pressurized from 
2,000 psi to their full pressure at T minus 
3 hours 20 minutes. This process is gradual to 
prevent excessive heat buildup in the supply 
tank. Regulated helium pressure is between 715 
and 775 psi. 


At this time, the MPS He ISOLATION A and B 
switches, the MPS PNEUMATICS L ENG He 
XOVR and He ISOL switches, and the MPS He 
INTERCONNECT LEFT, СТК, RIGHT switches 
on panel R2 are in the GPC position. With the 
switches in this position, the eight helium 
isolation valves are open, and the left engine 
crossover and the six helium interconnect valves 
are closed. 
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AC BUS SNSR Switches on Panel R1 


At T minus 16 minutes, one of the first actions by 
the flight crew (the pilot) is to place the six MPS 
He ISOLATION A and B switches and the MPS 
PNEUMATICS He ISOL switch on panel R2 in 
the OPEN position. This procedure will not 
change the position of the helium isolation 
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valves, which were already open, but it inhibits 
launch processing system control of valve 
position. 


During prelaunch, liquid oxygen from ground 
support equipment is loaded through the 
ground support equipment liquid oxygen T-0 
umbilical and passes through the liquid oxygen 
outboard fill and drain valve, the liquid oxygen 
inboard fill and drain valve, and the orbiter 
liquid oxygen feedline manifold. The liquid 
oxygen exits the orbiter at the liquid oxygen 
feedline umbilical disconnect and enters the 
liquid oxygen tank in the external tank. 


During loading, the liquid oxygen tank's vent 
and relief valves are open to prevent pressure 
buildup in the tank due to liquid oxygen loading. 
The MAIN PROPULSION SYSTEM 
PROPELLANT FILL/DRAIN ГО, OUTBD and 
INBD switches on panel R4 are in the GND 
(ground) position, which allows the launch 
processing system to control the positions of 
these valves. Just prior to lift-off, the launch 
processing system will first command the liquid 
oxygen inboard fill and drain valve to close. The 
liquid oxygen in the line between the inboard 
and outboard fill and drain valves is then 
allowed to drain back into the ground support 
equipment, and the launch processing system 
commands the outboard fill and drain valve to 
close. 


Also during prelaunch, liquid hydrogen 
supplied through the ground support 
equipment liquid hydrogen T-0 umbilical 
passes through the liquid hydrogen outboard 
fill and drain valve, the liquid hydrogen 
inboard fill and drain valve, and the liquid 
hydrogen feedline manifold. Тһе liquid 
hydrogen then exits the orbiter at the liquid 
hydrogen feedline umbilical disconnect and 
enters the liquid hydrogen tank in the external 
tank. During loading, the liquid hydrogen 
tank's vent valve is left open to prevent pressure 
buildup in the tank due to boiloff. The MAIN 
PROPULSION SYSTEM PROPELLANT 
FILL/DRAIN LH» OUTBD and INBD switches 
on panel R4 are in the GND position, which 
allows the launch processing system to control 
the position of these valves. 


During the T minus 3 hour hold the pilot 
positions the three AC BUS SNSR switches on 
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panel R1 to MONITOR to protect the main 
engine controllers. Each engine controller is 
powered by two of the three ac buses, one for 
each digital computer unit. The loss of one bus 
would result in a loss of controller redundancy 
on two engines, and the loss of any two buses 
would cause the associated engine to shut 
down. With the AC BUS SNSR switches 
positioned to MONITOR, the sensors will 
provide caution and warning for a potential 
over/undervoltage or overload condition, but 
they will not trip a bus off line before the crew 
can verify whether a true failure exists. 


Engine Start 


At T minus 4 minutes, the fuel system purge 
begins. It is followed at T minus 3 minutes 
25 seconds by the beginning of the engine 
gimbal tests, during which each gimbal actuator 
is operated through a canned profile of 
extensions and retractions. If all actuators 
function satisfactorily, the engines are gimbaled 
to a predefined position at T minus 2 minutes 
15 seconds. The engines remain in this position 
until engine ignition. 


At T minus 2 minutes 55 seconds, the launch 
processing system closes the liquid oxygen tank 
vent valve, and the tank is pressurized to 21 
psig with ground support equipment-supplied 
helium. The liquid oxygen tank's pressure can 
be monitored as MANF P LO2 on both the BFS 
СМС SYS SUMM 1 DPS display and on the 
OMS/MPS MEDS display. The 21-psig 
pressure corresponds to a liquid oxygen engine 
manifold pressure of 105 psia. 


At T minus 1 minute 57 seconds, the launch 
processing system closes the liquid hydrogen 
tank's vent valve, and the tank is pressurized to 
42 psig with ground support equipment- 
supplied helium. The pressure can be 
monitored as МАМЕ P LH2 on both the BFS 
GNC SYS SUMM 1 DPS display and the 
OMS/MPS MEDS display. 


At T minus 31 seconds, the onboard redundant 
set launch sequence is enabled by the launch 
processing system. From this point on, all 
sequencing is performed by the orbiter GPCs in 
the redundant set, based on the onboard clock 
time. The СРС$ still respond, however, to hold, 
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resume count, and recycle commands from the 
launch processing system. 


At T minus 16 seconds, the GPCs begin to issue 
arming commands for the solid rocket booster 
ignition pyro initiator controllers, the hold- 
down release pyro initiator controllers, and the 
1-0 umbilical release pyro initiator controllers. 


At T minus 9.5 seconds, the engine chill-down 
sequence is complete, and the GPCs command 
the liquid hydrogen prevalves to open. (The 
liquid oxygen prevalves are open during 
loading to permit engine chill-down.) Тһе 
MAIN PROPULSION SYSTEM LO» and LH» 
PREVALVE LEFT, CTR, RIGHT switches on 
panel R4 are in the GPC position. 


At T minus 6.6 seconds, the СРС» issue the 
engine start command, and the main fuel valve 
in each engine opens. Between the opening of 
the main fuel valve and MECO, liquid 
hydrogen flows out of the external tank/orbiter 
liquid hydrogen disconnect valves into the 
liquid hydrogen feedline manifold. From this 
manifold, liquid hydrogen is distributed to the 
engines through the three engine liquid 
hydrogen feedlines. | In each line, liquid 
hydrogen passes through the prevalve and 
enters the main engine at the inlet to the low- 
pressure fuel turbopump. 


When the GPCs issue the engine start command, 
the main oxidizer valve in each engine also 
opens. Between the opening of the main engine 
oxidizer valve and MECO, liquid oxygen flows 
out of the external tank and through the external 
tank/orbiter liquid oxygen umbilical disconnect 
valves into the liquid oxygen feedline manifold. 
From this manifold, liquid oxygen is distributed 
to the engines through the three engine liquid 
oxygen feedlines. In each line, liquid oxygen 
passes through the prevalve and enters the main 
engine at the inlet to the low-pressure oxidizer 
turbopump. 


If all three SSMEs reach 90 percent of their rated 
thrust by T minus 3 seconds, then at T minus 0, 
the GPCs will issue the commands to fire the 
solid rocket booster ignition pyro initiator 
controllers, the hold-down release pyro initiator 
controllers, and the T- 0 umbilical release pyro 
initiator controllers. ^ Lift-off occurs almost 
immediately because of the extremely rapid 
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thrust buildup of the solid rocket boosters. Тһе 
three seconds prior to T minus 0 allow the 
vehicle base bending loads to return to minimum 
by T minus 0. If one or more of the three main 
engines do not reach 90 percent of their rated 
thrust at T minus 3 seconds, all SSMEs are shut 
down, the solid rocket boosters are not ignited, 
and a pad abort condition exists. 


Ascent 


Beginning at T minus 0, the SSME gimbal 
actuators, which were locked in their special 
preignition position, are first commanded to 
their null positions for solid rocket booster start 
and then are allowed to operate as needed for 
thrust vector control. 


Between lift-off and МЕСО, as long as the 
SSMEs perform nominally, all MPS sequencing 
and control functions are executed 
automatically by the GPCs. During this period, 
the flight crew monitors MPS performance, 
backs up automatic functions, if required, and 
provides manual inputs in the event of MPS 
malfunctions. 


During ascent, the liquid hydrogen tank's 
pressure is maintained between 32 and 34 psig 
by the orifices in the two lines and the action of 
the flow control valve. 


The liquid oxygen tank's pressure is maintained 
between 20 and 25 psig by fixed orifices in the 
ET to SSME pressurization lines. A pressure 
greater than 30 psig will cause the tank to 
relieve through its vent and relief valve. 


The SSME thrust level depends on the flight: it 
is usually 104 percent, but the maximum setting 
of 109 percent may be required for emergency 
situations. PASS commanded thrust (THROT) is 
displayed in PASS ASCENT TRAJ 1 and TRAJ 2 
displays. Тһе throttle level that would be 
commanded by the BFS (T) is displayed on the BFS 
ASCENT TRAJ 1 and TRAJ 2 displays. Actual 
throttle levels are read on the OMS/MPS MEDS 
display. As dynamic pressure rises, the GPCs 
throttle the engines to a lower power level 
(typically 72 percent) to minimize structural 
loading while the orbiter is passing through the 
region of maximum aerodynamic pressure. 
This is called the "thrust bucket" because of the 
way the plot looks like a bucket on a graph of 
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thrust versus mission elapsed time (MET). 
Although the bucket duration and thrust level 
vary, a typical bucket runs from about 30 to 65 
seconds MET. The solid rocket booster 
propellant is also shaped to reduce thrust. At 
approximately 65 seconds MET, the engines are 
once again throttled up to the appropriate 
power level (typically 104 percent) and remain 
at that setting for a normal mission until 3-g 
throttling is initiated. 


SRB separation is the next major event on 
ascent. Тһе SRBs burn out after about 2 
minutes of flight. Appearance of an overbright 
"Pc « 50" (SRB chamber pressure is less than 50 
psi) on the trajectory display indicates to the 
crew that the SRB separation sequence has 
begun. Actual separation occurs about 5 
seconds later to allow for 5КВ thrust tailoff. 
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Liquid oxygen manifold pressure is greatly 
affected by acceleration from the SRBs, but 
because of its low density, liquid hydrogen is not. 
At SRB separation, the liquid oxygen manifold 
pressure will drop from well over 100 psia to 
approximately 50 psia. Pressure rises again as 
the vehicle approaches 3 g's. The crew can 
monitor the manifold pressures (MANF P) on 
both the BFS GNC SYS SUMM 1 display and on 
the OMS/MPS MEDS display. 


Beginning at approximately 7 minutes 
30 seconds MET, the engines are throttled back 
as necessary to maintain vehicle acceleration at 
3 g's or less. Three g's is an operational limit 
devised to prevent excessive physical stress on 
the flight crew and vehicle. Approximately 
six seconds before MECO (the period known as 
“fine count), the engines are throttled back to 
the minimum 67 percent in preparation for 
shutdown. 


Main Engine Cutoff (MECO) 


Normally, the GPCs command MECO once the 
vehicle has attained a specified velocity. The 
cutoff bugs on the PASS ASCENT TRAJ 2 and the 
BFS ASCENT TRAJ 2 displays march across the 
top of the display leading up to MECO and 
reach the “CO” tick mark at MECO. 


The engines can also be shut down due to a 
“low-level cutoff,” where the liquid oxygen or 
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liquid hydrogen are depleted before the 
specified MECO velocity is reached. Liquid 
oxygen depletion is sensed by four sensors in 
the orbiter liquid oxygen feedline manifold. 
Liquid hydrogen depletion is sensed by four 
sensors in the bottom of the liquid hydrogen 
tank. If any two of the four sensors in either 
system indicate a dry condition (assuming the 
propellant mass has dropped to the point where 
the sensors have been armed), the GPCs will 
issue a МЕСО command to the engine 
controllers. This allows the engines to safely 
shutdown while there is still enough propellant 
to avoid cavitating the turbopumps. 


The crew observes MECO through the 
illumination of the three red MAIN ENGINE 
STATUS lights on panel F7 and the Рс 
indicators on the OMS/MPS MEDS display 
dropping to 
0 percent. Four of the ORBITAL DAP 
pushbutton lights on panel СЗ illuminate, 
indicating that the Trans DAP has been 
activated and that the MECO CONFIRMED 
software flag has been set. This flag must be set 
to enter the ET separation sequence. (NOTE: 
the DAP lights will not illuminate on an RTLS 
abort since the Trans DAP is not activated at 
MECO. The MECO CONFIRMED flag, 
however, is still set.) 
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Once МЕСО has been confirmed ай 
approximately 8 minutes 30 seconds MET, the 
GPCs execute the external tank separation 
sequence. The sequence takes approximately 
20 seconds to complete and includes opening 
the feedline relief isolation valves, arming the 
external tank separation pyro initiator 
controllers, closing the liquid hydrogen and 
liquid oxygen feedline 17-inch disconnect 
valves, turning the external tank signal 
conditioners' power off (deadfacing), firing the 
umbilical unlatch pyrotechnics, retracting the 
umbilical plates hydraulically, and gimbaling 
the SSMEs to the MPS dump sequence position. 


At this point, the computers check for external 
tank separation inhibits. If the vehicle's pitch, 
roll, and yaw rates are greater than 0.7 degree 
per second, or the feedline disconnect valves 
fail to close, automatic external tank separation 
is inhibited. If these inhibit conditions are met, 
the GPCs issue the commands to the external 
tank separation pyrotechnics. The crew has the 
capability to override the external tank 
separation with the ET SEPARATION switch 
located on panel C3. Also, a deflection of the 
forward translational hand controller (THC) 
will interrupt the separation sequence. 


At ET separation, the gaseous oxygen and 
gaseous hydrogen feedlines are sealed at the 
umbilicals by self-sealing quick disconnects. 


Post-MECO 


Ten seconds after MECO, the backup liquid 
hydrogen dump valves are opened for two 
minutes to ensure that the liquid hydrogen 
manifold pressure does not result in operation 
of the liquid hydrogen feedline relief valve. 


After external tank separation, approximately 
1,700 pounds of propellant are still trapped in 
the SSMEs, and an additional 3,700 pounds of 
propellant remain trapped in the orbiter's MPS 
feedlines. This 5,400 pounds of propellant 
represents an overall center-of-gravity shift for 
the orbiter of approximately 7 inches. Non- 
nominal center-of-gravity locations can create 
major guidance problems during entry. The 
residual liquid oxygen, by far the heavier of the 
two propellants, poses the greatest impact on 
center-of-gravity travel. 
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A hazard from the trapped liquid hydrogen 
occurs during entry, when any liquid or gaseous 
hydrogen remaining in the propellant lines may 
combine with atmospheric oxygen to form a 
potentially explosive mixture. In addition, if the 
trapped propellants are not dumped overboard, 
they will sporadically outgas through the orbiter 
liquid oxygen and liquid hydrogen feedline relief 
valves, causing slight vehicle accelerations. 


The MPS propellent dumps (LO2 and LH2) 
occur simultaneously. Both dumps аге 
completely automatic. The helium subsystem is 
used during the MPS dump to help expel the 
liquid oxygen from the LO2 manifold. То 
support this, at MECO plus 20 seconds, the 
GPCs interconnect the pneumatic helium and 
engine helium supply system by opening the 
center and right out/open interconnect valves 
and the left in/open interconnect valve if the 
MPS He INTERCONNECT LEFT, CTR, RIGHT 
switches on panel R2 are in the GPC position. 
This connects all 10 helium supply tanks to a 
common manifold, and it ensures that sufficient 
helium is available to perform the liquid oxygen 
and liquid hydrogen propellant dumps. 


The MPS dump starts automatically at MECO 
plus 2 minutes. The MPS dump may be started 
manually by taking the MPS PRPLT DUMP 
SEQUENCE switch to START. The earliest that 
the manual MPS dump can be performed is 
MECO plus 20 seconds. The only reason that 
the crew may need to start the dump prior to 
MECO plus 2 minutes is if the LO2 or LH2 
manifold pressure rises unexpectedly. The MPS 
dump will start automatically prior to MECO 
plus 2 minutes if the LH2 manifold pressure is 
greater than 60 psi. The dump takes 2 minutes 
to complete. The STOP position of the MPS 
PRPLT DUMP SEQUENCE switch prevents the 
automatic dump from starting during the ET 
separation sequence if it is delayed by an RCS 
leak or feedline disconnect valve failure. 


For the LO2 dump, the GPCs command the two 
liquid oxygen manifold repressurization valves 
to open (the MAIN PROPULSION SYSTEM 
MANF PRESS LO2 switch on panel R4 must be 
in the GPC position), command each engine 
controller to open its SSME main oxidizer valve 
(MOV), and command the three liquid oxygen 
prevalves to open (the LO2 PREVALVE LEFT, 
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CTR, RIGHT switches on panel R4 must be in 
the GPC position). The liquid oxygen trapped 
in the feedline manifolds is expelled under 
pressure from the helium subsystem through 
the nozzles of the SSMEs. This dump is 
propulsive and typically provides a change in 
orbital velocity of about 9 to 11 fps. 


The pressurized liquid oxygen dump continues 
for 90 seconds. At the end of this period, the 
GPCs automatically terminate the dump by 
closing the two liquid oxygen manifold 
repressurization valves, wait 30 seconds, and 
then command the engine controllers to close 
their SSME main oxidizer valve. The three 
liquid oxygen prevalves remain open during 
the orbit phase of the flight. 


Concurrent with the liquid oxygen dump, the 
GPCs automatically initiate the MPS liquid 
hydrogen dump. The GPCs command the two 
liquid hydrogen fill and drain valves (inboard 
and outboard) to open, the topping valve to 
open, and the three LH2 prevalves to open. 


The liquid hydrogen trapped in the orbiter 
feedline manifold is expelled overboard without 
pressure from the helium subsystem. The liquid 
hydrogen flows overboard through the inboard 
and outboard fill and drain valves, and the 
topping valve for two minutes. The GPCs 
automatically stop the dump by closing the 
liquid hydrogen outboard fill and drain valve 
and the topping valve. 


At the end of the liquid oxygen and liquid 
hydrogen dumps, the GPCs close the helium 
out/open and in/open interconnect valves, 
provided the He INTERCONNECT LEFT, CTR, 
RIGHT switches on panel R2 are in the GPC 
position. After the MPS dump is complete, the 
SSMEs are gimballed to their entry stow position 
with the engine nozzles moved inward (toward 
one another) to reduce aerodynamic heating. 
Although the gimbals move to an MPS dump 
position during the external tank separation, the 
I-loads are currently the same as the entry stow 
position. At this time, the BODY FLAP lights on 
panel F2 and F4 turn off. This is the crew's 
indication that the MPS dump is complete. 


In the post OMS-1 procedures, the pilot positions 
all six MPS ENGINE POWER switches on panel 
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R2 to OFF, which removes all power to the main 
engine controllers. Once power is removed from 
the controllers, the main oxidizer valves (through 
which the residual liquid oxygen is dumped) can 
no longer be operated. 


The pilot also positions the six He ISOLATION 
switches and the PNEUMATIC He ISOLATION 
switch to GPC at this time. When this is done, 
the helium isolation valves automatically close. 
This cuts off helium to the helium regulators, 
which then begin to bleed down. 


NOTE 


As the helium regulators bleed down, 
they trigger multiple MASTER ALARMS, 
which the crew can expect. 


The external tank gaseous hydrogen 
pressurization manifold is manully vacuum 
inerted by opening the hydrogen pressurization 
line vent valve by placing the MAIN 
PROPULSION SYSTEM H2 PRESS LINE VENT 
switch on panel R4 to OPEN. After about one 
minute, the switch is taken back to the GND 
position, which closes the valve. The hydrogen 
pressurization vent line valve is electrically 
activated; however, it is normally closed 
(spring-loaded to the closed position). 
Removing power from the valve solenoid closes 
the valve. 


Vacuum Inerting 


Fifteen minutes after the MPS dump stops, the 
GPCs initiate the sequence for vacuum inerting 
the orbiter's liquid oxygen and liquid hydrogen 
manifolds. Vacuum inerting allows traces of 
liquid oxygen and liquid hydrogen trapped in 
the propellant manifolds to be vented into space. 


The LO2 vacuum inerting is accomplished by the 
GPCs opening the LO2 inboard and outboard fill 
and drain valves. The LH2 vacuum inerting is 
accomplished by the GPCs opening the backup 
LH2 dump valves. 


The liquid oxygen and hydrogen lines are 
inerted simultaneously for two minutes. At the 
end of the sequence, the GPCs close the LO2 
outboard fill drain valve and the LH2 backup 
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dump valves. Тһе LO2 and LH2 inboard valves 
are left open to prevent a pressure buildup 
between the inboard and outboard valves. 


Any GPC or FA MDM failure that will not 
allow the automatic vacuum inert to function 
properly will require the crew to perform a 
manual vacuum inerting procedure. 


Following the OMS 2 burn, upon transition to 
MM 106, the LH2 system goes through a second 
vacuum inerting to evacuate all of the residual 
liquid hydrogen. Residual hydrogen ісе 
sublimates quickly after the OMS 2 burn (and 
the LH2 manifold pressure rises) due to the 
vibrations induced by the firing of the OMS 
engines. This second inert takes about three 
minutes to complete. 


Post Insertion 


In the post insertion portion of the flight, the 
MPS is essentially unpowered. 


On panel L4, the 18 circuit breakers connecting 
ac power to the main engine controllers are all 
opened to reduce the risk of a short. 


Via switches on panel O17, the four ascent 
thrust vector control (ATVC) units, the three 
engine interface units (EIUs), and the two 
master events controllers (MECs) are all 
powered OFF. 


The hardware C/W system is reconfigured to 
inhibit caution and warning on the helium tank 
pressures and the "A" regulators, since the 
helium system is secured and no longer used. 
In the event of an incomplete MPS dump, the 
LH2 and LO2 manifold pressure caution and 
warning is left enabled to alert the crew to a 
possible high manifold pressure while on orbit. 


Orbit 


АП main propulsion systems have been secured 
by the time post insertion is complete. The MPS 
orbit procedures deal with  off-nominal 
manifold pressures and are not normally 
performed. The concern on orbit is possible 
high manifold pressures due to an incomplete 
vacuum inert or MPS dump. If high manifold 
pressures were detected during orbit, the MCC 
would advise the crew to perform a manual 
vacuum inert. If the MCC were not available, 


2.16-35 


USA007587 
Rev. A 


the manifold pressure caution and warning 
parameter (left enabled during post insertion ) 
would alert the crew of the high manifold 
pressure and the malfunction procedure would 
be performed, relieving the pressure ог 
deducing a manifold pressure transducer 
failure. 


Deorbit Prep 


During the deorbit prep timeframe, the MPS 
hardware C/W is reconfigured in preparation 
for entry. First, the MPS helium "A" regulators 
are re-enabled. Helium will be used for the 
entry purge and manifold repressurization. The 
hardware C/W will help the crew identify a 
regulator that has failed high before it over- 
pressurizes the aft compartment. Next, the 
manifold pressure is inhibited. The manifolds 
are at a vacuum state and do not need to be 
monitored during entry. 


Also during deorbit prep, the ATVC switches 
are powered back on. This will allow the main 
engine nozzles, which may have drifted out of 
position while on orbit, to return to their entry 
stow positions. Activating the ATVCs also 
supports SSME repositioning for drag chute 
deploy, which automatically occurs during 
glided flight. 


Entry 


The GPCs reconfigure the MPS helium system 
in preparation for the entry repressurization 
and purge at the MM 303 transition. 


NOTE 


Expect the F7 MPS light to be on until 
MM 303. 


Once MM 303 is entered, the GPCs command 
the PNEUMATIC ISOLATION A and B, and the 
L ENG He XOVR to OPEN provided the switch 
is in the GPC position. At the same time, the 
MPS He INTERCONNECTS CTR and RIGHT 
are commanded out/open, while the MPS He 
INTERCONNECT LEFT is commanded ш/ 
open. This feeds all the MPS helium through 
the left engine, through the PNEUMATICS L 
ENG He XOVR, and through the pneumatic 
isolation valves. Also at this time, the LH2 
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RTLS dump valves go open to insure the LH2 
manifold is completely vented prior to entry. 


At a ground-relative velocity (VreL) of 8000 fps 
(around an altitude of 151,000 feet), the ATVCs 
pitch down the main engine bells out of the way 
of the drag chute when it is deployed after 
touchdown. 


At a Увш, of 5300 fps (between 130,000 and 
110,000 feet altitude, depending on the entry 
trajectory), the helium blowdown valves open 
which allows helium to continuously purge the 
aft compartment, OMS pods, and the LH2 
umbilical cavity area. There is no manual 
control of the blowdown valves. The 
blowdown purge continues for 650 seconds and 
typically ends a few minutes after touchdown. 


Also at a Мен. of 5300 fps, the MAIN 
PROPULSION SYSTEM MANF PRESS LH2 & 
LO2 valves are commanded OPEN, provided 
the switches on panel R4 are in the GPC 
position. This allows the LH2 and LO2 
manifolds to be pressurized, preventing 
contaminants from entering the manifolds 
during entry. Removing contamination from 
the manifolds or feedlines can be a long and 
costly process since it involves disassembly of 
the affected parts. The manifold repress 
continues until the ground crews install the 
throat plugs in the main engine nozzles. 
Further, the LH2 backup dump valves and the 
102 prevalves go closed. 


RTLS Abort Propellant Dump Sequence 


For RTLS abort, immediately post-MECO, the 
valve sequencing is the same as for a nominal 
MECO. After approximately 25 seconds, the 
vehicle enters MM 602 and the RTLS dump 
begins. The RTLS entry dump differs only 
slightly from the nominal entry dump. 


During the RTLS dump, liquid oxygen is 
initially dumped through the LO2 prevalves 
and through the main oxidizer valves (MOVs) 
in the SSMEs. When the dynamic pressure is 
above 20 psf (plus an I-load), there is a 
subsequent venting through the liquid oxygen 
fill and drain valves. This dump is done 
without helium pressurization and relies on the 
self-boiling properties of the liquid oxygen. In 
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the RILS liquid oxygen dump, the GPCs 
terminate the dump whenever the ground 
relative velocity drops below 3,800 feet-per- 
second. The liquid oxygen system is 
repressurized when Vre is 3800 fps, and 
repressurization continues as in a nominal 
entry. 


LH2 manifold is expelled in the same manner as 
the nominal post-MECO dump (with one 
exception) until Уке is 3800 fps, at which time 
the valves are closed. The only exception is that 
the RTLS LH2 dump is assisted by helium 
pressurization through the RTLS manifold 
pressurization valves for two minutes, beginning 
at RTLS dump start. 


The entry repressurization and the ан 
compartment surge also occur during the RTLS. 
The helium blowdown valves are opened at 
VreL of 5300 fps, followed by the manifold 
repress valves opening at a Ук of 3800 fps. As 
with the nominal entry, the blowdown valves 
remain open until a few minutes after landing. 


TAL Abort Propellant Dump Sequence 


For a TAL abort, the entire dump sequence is 
the same as that for RTLS. On the TAL, the 
dump begins at the transition to MM 304. 


The LO2 is also dumped at the MM 304 
transition through the LO2 prevalves and then 
out the MOVs, just as in the nominal dump. То 
assist in removing the LO2 propellants, the LO2 
inboard and outboard fill drains are opened at a 
VreL of 20,000 fps if the LO2 manifold pressure 
is less than 30 psi. 
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MPS Caution and Warning Summary 


е Data path failure is the loss of both primary 


and secondary data paths between the engine 
controller and the GPCs. Data path failure 
indications include an SM ALERT light and 
audio tone, an amber MAIN ENGINE 
STATUS light on panel F7, the engine Pc 
meter on the OMS/MPS MEDS display 
driven to zero, and an “MPS DATA L (С, К)” 
message. 


Command path failure is when the engine 
controller does not receive 2/3 valid inputs 
from the GPCs. The engine will not respond 
to any commands, such as throttling or 
shutdown. Indications include an SM 
ALERT light on panel F7 and audio tone, an 
amber MAIN ENGINE STATUS light on 
panel F7, no change in the Pc meter during 
throttling, and an “MPS CMD L (С, RY 
message. This message will only annunciate 
on the PASS pre-BFS engage. 


Hydraulic lockup occurs when the engine 
controller senses any of the five hydraulically 
actuated engine valves out of position. The 
engine will no longer throttle. Indications 
are an SM ALERT light and audio tone, an 
amber MAIN ENGINE STATUS light on 
panel F7, no change in Pc meter during 
throttling, and an “MPS HYD Г (С, К)” 
message. 


Electric lockup occurs when the controller 
loses all Pc or all fuel flow rate data from the 
engine. The engine will no longer throttle. 
Indications are SM ALERT light and audio 
tone, an amber MAIN ENGINE STATUS light 
on panel F7, no change in Pc meter during 
throttling, and “MPS ELEC L (C, R)” message. 


Engine failure indications are a visual and 
audible MASTER ALARM, a red MAIN 
ENGINE STATUS light, engine Pc meter 
reading of zero, a Backup C&W Alarm light 
on the F7 C/W matrix, and an “SSME FAIL L 
(C, R)” message on the DPS display. A drop 
in acceleration also occurs but may be hard 
to detect (especially in MM 102, pre SRB 
SEP). 


ET SEP switch failures are shown by an SM 
alert light and an “ET SEP MAN” or “ET SEP 
AUTO” message. MAN is the default 
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software position for NOM/ATO; AUTO, for 
RTLS/TAL. This is annunciated by the PASS 
only (since BFS has no switch RM). 


Main engine shutdown pushbutton failures 
cause an “ME SHDN SW C(L,R)” message 
and an SM alert light and tone that is 
annunciated by the PASS only (since BFS has 
no switch RM). 


Liquid hydrogen ullage pressure below 28.0 
psia is indicated by an SM ALERT light and 
audio tone, one or more down arrows by the 
LH2 pressure readings on the BFS GNC SYS 
SUMM 1 display, and an “MPS LH2/O2 
ULL” message on the BFS DPS display. 


High liquid hydrogen or liquid oxygen 
manifold pressure indications are: a visual 
and audible MASTER ALARM, out of limits 
indications by the applicable MANF P 
reading on both the BF5 GNC SYS SUMM 1 
display and the OMS/MPS MEDS display, 
and an “МР5 LH2/LO2 МАМЕ” message on 
the DPS display. The limits are 249 psia for 
liquid oxygen, and 65 ряа for liquid 
hydrogen. 


Helium tank leaks or regulator failure are 
indicated by an SM ALERT light and audio 
tone, an up arrow by the applicable dP/dT or 
regulator on the BFS GNC SYS SUMM 1 
display, and an “MPS He P C (L, R)” 
message. 


ET separation inhibit is indicated by an SM 
ALERT light and audio tone and an “ET SEP 
INH” message. 


The MPS light on panel F7 illuminates (red) 
if liquid hydrogen manifold pressure exceeds 
65 psia on orbit or liquid oxygen manifold 
pressure exceeds 249 psia on orbit. A 
MASTER ALARM also illuminates, an audio 
alarm sounds, and the red BACKUP СЛУ 
ALARM on panel F7 is lit as well. The light 
will also illuminate for helium pressure 
below 1,150 psia or regulated helium 
pressure below 680 or above 810 psia on the 
"A" regulators only. 


The red upper half of the MAIN ENGINE 
STATUS lights on panel F7 will be 
illuminated for an engine in shutdown or 
post-shutdown phase or exceeding redline 
limits with limits inhibited. 
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MPS Caution and Warning Summary (continued) 


e MPS pneumatic system anomalies are 


annunciated by an SM alert light and audio 
tone, and an applicable message on the BFS 
DPS display. The following pneumatic 
system messages are annunciated along 
with an SM alert light and audio tone for 


the given condition. 


MPS PNEU TK, 


pneumatic tank pressure drops below 
3800 psi. MPS PNEU ACUM, pneumatic 
accumulator pressure drops below 700 psi. 
MPS PNEU REG, pneumatic regulator 
pressure drops below 700 psi or goes above 
810 psi. 
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MPS Summary Data 


The main engines, assisted by two solid 
rocket motors during the initial phases of the 
ascent trajectory, provide the vehicle 
acceleration from lift-off to MECO at a 
predetermined velocity. 


Most of the MPS is located at the aft end of 
the orbiter beneath the vertical stabilizer. 


The MPS consists of three SSMEs and 
controllers, the external tank, propellant 
management and helium systems, four 
ascent thrust vector control units, and six 
hydraulic servoactuators. 


The SSMEs are reusable, high-performance 
engines that use liquid hydrogen for fuel and 
cooling and liquid oxygen as an oxidizer. 


The SSMEs can be throttled 67 to 109 percent 
in 1 percent increments. Thrust level values 
are: 100 percent = 375,000 pounds at sea 
level, 470,000 pounds in a vacuum; 104 
percent = 393,800 pounds at sea level, 488,000 
pounds in a vacuum; 109 percent = 417,300 
pounds at sea level, 513,250 pounds in a 
vacuum. 


Major SSME components are fuel and 
oxidizer turbopumps, preburners, a hot gas 
manifold, main combustion chamber, nozzle, 
oxidizer heat exchanger, and propellant 
valves. 


Each SSME has a controller with two 
redundant digital computer units. Operating 
in conjunction with engine sensors, valves, 
actuators, and spark igniters, the controllers 
form a self-contained system for engine 
control, checkout, and monitoring. 
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The propellant management system consists 
of manifolds, distribution lines, and valves 
that transport propellant from the external 
tank to the three main engines for 
combustion, and gases from the engines to 
the external tank for pressurization. 


The helium system consists of 10 supply 
tanks and associated regulators, check 
valves, distribution lines, and control valves. 


The helium system is used for: (1) in-flight 
engine purges, (2) pressure for emergency 
closing of engine valves, (3) pressure to 
actuate pneumatically operated propellant 
valves, (4) expelling the propellants during 
the MPS dump and (5) entry purge and 
repressurization. 


There is one helium system per engine, plus 
a fourth pneumatic system to operate the 
propellant valves. 


The three orbiter hydraulic systems supply 
hydraulic pressure to the MPS to actuate 
engine valves and provide engine gimballing 
for thrust vector control. 


MPS controls are located primarily on panels 
R2 and R4, and C3 with a few on panels F7, 
O17, and R1. 


MPS system status indicators appear on 
several displays, which include OMS/MPS 
MEDS, BFS GNC SYS SUMM 1, and both 
PASS and BFS ASCENT TRAJ 1 and 2. 
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MPS Rules of Thumb 


e Direct insertion MECO is usually close to 
8 minutes 30 seconds MET. 


An SSME will consume approximately 
4 percent propellant per engine per minute at 
104 percent. Propellant remaining is 
displayed on the PASS ASCENT TRAJ 2 
display and is a guidance-calculated number. 


When an engine fails, the helium dP/dT is 
greater than 40 for several seconds, due to 
engine shutdown purges, and then it goes to 
zero. This is a good crosscheck to confirm 
engine shutdown. 


Two automatic ways to set MECO confirm 
are: three Pc's < 30% or two Pc's <30% and a 
data path failure on the third SSME. Three 
manual ways to set MECO confirm are: push 
the three 55МЕ PB's, OPS 104 PRO, or FAST 
SEP. 


Both PASS and BFS do not require all three 
MAIN ENGINE SHUT DOWN pushbuttons 
simultaneously to set MECO confirmed. 


To shut down an engine, both contacts on the 
MAIN ENGINE SHUT DOWN pushbutton 
must be good. If one contact is commfaulted, 
the button can only be used to set the safing 
flag on an engine that failed under a data 
path failure. If, however, a contact is power- 
failed, the button is totally inoperative. 


In the BFS, if a contact on the MAIN ENGINE 
SHUT DOWN  pushbutton is either 
commfaulted or power-failed, the button is 
totally inoperative. 


An 55МЕ command path failure must always 
be shut down manually with the A/C 
switches and PBs. 


Shutdown with A/C switches will always 
cause a data path failure. 
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An "SSME FAIL C (L, R)" message indicates 
that the GNC software has recognized an 
engine shut down. 


An engine in data path failure will never 
display a red MAIN ENGINE STATUS light. 


There are no direct indications to the crew of 
limit shutdown enable/inhibit status. The 
status is available to the MCC, or it can be 
deduced by the crew. 


Limits must be enabled on an engine when 
the helium regulator pressure begins to 
decay due to a helium leak. An SSME will 
fail catastrophically if there is insufficient 
helium, and limit shutdown is inhibited. 


Loss of an APU in powered flight will result 
in a hydraulic lockup. 


An SSME in hydraulic or electric lockup may 
require a pre-MECO shutdown. 


Actual throttle levels on the first stage 
throttle bucket can vary due to SRB thrust 
level dispersions. This is an artifact of "first 
stage adaptive guidance." 


Manual SSME shutdown typically occurs 
about 30 seconds before MECO. This 
corresponds to: V; = 23K (3-eng uphill), 
Vi = 24.5K (2-eng uphill), and Уі = 22.5K 
(TAL). 


МР5 ENGINE POWER switches look very 
similar to He ISOLATION switches and are 
located close together on panel R2. Use 
caution. 


Loss of ALC 1, 2, 3 (APC 4, 5, 6) will cause 
SSME helium isolation A to close on the C, L, 
К SSME, respectively. По not attempt 
subsequent helium leak isolations. 
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Mechanical Systems Summary 


Description 


The orbiter’s mechanical systems are those 
components that must be deployed, stowed, 
opened, or closed. An electrical or hydraulic 
actuator physically moves each of these 
components. 


The mechanical systems include the active vent 
system, external tank (ЕТ) umbilical doors, 
payload bay doors, deployable radiator system, 
and the landing and deceleration system. The 
landing and deceleration system is discussed in 
Section 2.14, and the radiators are included in 
Section 29. Descriptions of the remaining 
systems, as well as their operations are 
discussed in this section. 


There are other orbiter systems that use 
mechanical actuators but they аге not 
considered mechanical systems. These systems 
are not discussed in this section. Instead, they 
are covered in the following sections: Section 
2.4, Ku-band Antenna; Section 2.13, Star Tracker 
Doors and Air Data Probes; and Section 2.19, 
Payload Retention Latches. 
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Electromechanical Actuators 


The orbiter’s electromechanical actuators, also 
called power drive units (PDUs), contain two 
three-phase alternating current (AC) motors, 
brakes, a differential assembly, a gearbox, and 
limit switches. Except for the ET door 
centerline latches, all actuator assemblies also 
contain torque limiters. 


Power for the actuator motors апа limit 
switches is provided by the orbiter’s motor 
control assemblies (MCAs). The MCAs are 
powered via MCA LOGIC switches and circuit 
breakers on panel MA73C. 


Nominally, both of an actuator’s AC motors will 
drive at the same time, which is referred to as 
dual motor drive. If only one motor is driving, 
it is called single motor drive. If a mechanism is 
being driven with single motor drive, it will 
take twice as long to reach the desired position 
than it would with dual motor drive. 


Commands are sent to the MCAs to turn the AC 
motors on and off. Commands can originate 
from the general purpose computers (GPCs), data 
processing system (DPS) item entries, ог 
hardwired switches. These commands are sent 
via multiplexer/demultiplexers (MDMs). Each 
actuator motor is commanded through a 
separate МОМ; therefore, the loss of one MDM 
will not cause the loss of an entire actuator. 


The AC motors are reversible so that 
mechanisms may be driven in both directions 
(open or closed, stowed or deployed, latched or 
released). When a mechanism reaches the 
commanded position, the limit switches send 
signals back to the MCA to open relays that 
remove the AC power to the associated motors. 
These limit switch signals also provide feedback 
through telemetry, DPS displays, and talkbacks 
in the crew compartment. 
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Active Vent System 


The active vent system (AVS) equalizes the 
orbiter's unpressurized compartments to the 
ambient environment as the orbiter travels from 
the pressurized atmosphere of Earth to the 
vacuum of space. 


The AVS consists of 14 vent ports (7 on each 
side) in the orbiter fuselage. For identification, 
each door is numbered forward to aft. 


Originally, there were a total of 18 vents. Ап 
engineering analysis showed that vent ports 3, 
5, and 6 provide sufficient venting of the 
payload bay and mid-fuselage compartments. 
Because of this, vent ports 4 and 7 were 
permanently capped shut on both sides of 
Atlantis and Discovery. The associated 
actuators and linkages also were removed. 
Endeavour did not have the equipment 
installed. 


Each vent door has a pressure seal and a 
thermal seal, and is driven inward by its 
associated electromechanical actuator. The vent 
openings are sized according to the volume to 
be vented. 


The doors for the vent ports are opened and 
closed during the mission to perform the 
functions of the AVS. Normal opening or 
closing time is 5 seconds for each vent door, 
with dual motor drive. 


Some of the vent doors (1, 2, 6, 8, and 9) also 
have intermediate positions to provide the 
capability to purge the  unpressurized 
compartments with dry air or nitrogen. Purge 
operations are performed on the ground to 
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provide thermal conditioning, moisture control, 
and to exclude hazardous gases or 
contaminants. 


Vent Operations 


Ihe vent doors are controlled by а СМС 
software sequence that can be started by a 
master timing unit, major mode transition, 
velocity, or DPS item entry. 


When commanded via item entry by the crew, they 
will use GNC SPEC 51 OVERRIDE in the PASS. 
There are similar capabilities in the ВЕ5, but the 
item entries on the BFS page are only legal if BFS is 
engaged. 


During countdown, the vent doors are in their 
purge positions until 1-28 seconds, when the 
OPEN sequence is automatically called by the 
redundant set launch sequencer (К515). The 
vent doors are commanded open in a staggered 
sequence at approximately 2.5-second intervals. 


Тһе vent doors remain open during ascent, 
orbital insertion, and all on-orbit phases. 
During entry preparation, the crew performs a 
DPS item entry on GNC SPEC 51 OVERRIDE to 
close the vent doors. At this time, all the vent 
doors are commanded closed and then port 
vents 1, 2, 8, and 9 are automatically reopened. 
These vents are left open to vent any hazardous 
gases during the deorbit burn and to prevent 
vehicle overpressurization should a rapid orbital 
maneuvering system (OMS)/reaction control 
system (RCS) leak occur. These vents are 
automatically closed at the MM304 transition. 
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Area Vented 


FWD RCS and fuselage 
Midbody, payload 
Midbody, payload 
Midbody, payload/wing * 
Aft fuselage/OMS PODS 


Positions 


OPEN/CLOSE/PURGE 
OPEN/CLOSE 
OPEN/CLOSE/PURGE 
SEALED 
OPEN/CLOSE/PURSE 


Type Actuator 


Common 
Single 
Single 
Removed 
Common 


* OV-105 and others after Orbiter Maintenance Down Period (Major Mod) J-1. 


Vent Locations 


When the relative velocity of the orbiter reaches 
2400 ft/s on entry, all the vent doors are 
automatically commanded open, allowing the 
unpressurized compartments to equalize with 
the ambient atmosphere. 


Postlanding, once in OPS 9, the crew will 
perform DPS item entries on GNC SPEC 105 
TCS CONTROL to configure the AVS for purge 
operations. 


Nominally, the AVS operates automatically 
except for the preentry and розЧап@ те 
configuration, which are commanded by the 
orbiter crew at the appropriate times. In the 
return-to-launch site (RTLS) abort, the vent 
doors are automatically commanded closed at 
MM 602. For a transoceanic abort landing 
(TAL), the vent doors are automatically 
commanded closed at ET separation. 
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РА55/ВЕ5 


Ма]ог Мо4е 
(RTLS) 
OPEN 
ITEM 43 
All doors open 


All doors open 


All doors open All doors close 
Port 1, 2, 8, 9 open All doors close 


until rollout flag set 
until rollout flag set 


Manual Vent Door Command Capability during Entry 


External Tank Umbilical Doors 


Electrical and fuel umbilicals between the exter- 
nal tank and the orbiter enter the shuttle 
through two aft umbilical openings located on 
the underside of the orbiter. These umbilical 
cavities contain the orbiter/ET attachment 
points and the fuel and electrical disconnects. 
The left cavity contains the liquid hydrogen 
umbilical, and the right cavity contains the 
liquid oxygen umbilical. 


Each umbilical cavity has an associated ET 
door. During ascent, this door is open to allow 
the umbilical connections between the orbiter 
and the ET. After the ET separates from the 
orbiter, the two aft umbilical openings are 
exposed. The ET doors are closed to cover these 
exposed areas and to shield them from entry 
heating. 


A closeout curtain is installed at each of the 
orbiter/external tank umbilicals. After ET 
separation, the residual liquid oxygen in the 
main propulsion system is dumped through the 
three SSMEs and the residual liquid hydrogen 
is dumped overboard. The umbilical curtain 
prevents hazardous gases (gaseous oxygen and 
hydrogen) from entering the orbiter aft fuselage 
through the umbilical openings before the 
umbilical doors are closed. 
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CLOSE 
ITEM 44 
All doors close; 


then port 1, 2, 8, 9 
Auto reopen 


All doors close 


Each umbilical door, which is approximately 50 
in2, is covered with reusable thermal protection 
system tiles. Additionally, each door has an 
aerothermal barrier that requires approximately 
6 psi to seal it with adjacent thermal protection 
tiles. 


There are two types of latches associated with 
the ET doors, centerline latches and uplock 
latches. The centerline latches hold the ET 
doors open during ascent, and the uplock 
latches secure the doors when they are closed. 


The centerline latches must be disengaged from 
the doors before both ET doors can be closed. 
In the latched position, each centerline latch fits 
into a notch on the outer edge of the left and 
right ET doors. When stowed, the two center- 
line latches rotate and retract into the body of 
the orbiter so that they are flush with the orbiter 
thermal protection system mold line. 


After the ET doors are closed, uplock latches 
pull the doors fully closed, compressing them 
against aerothermal seals and positioning them 
flush with the orbiter body. These latches 
secure each door closed and prevent them from 
vibrating or opening during reentry. 


Three uplock latches are located inside each 
umbilical cavity. The latches engage three 
uplock rollers located on each ET door. The 
latches can engage the rollers as long as the ET 
door is within 2 inches of being closed. 
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ET Door Positions 
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Door Uplock Latch and Roller 


CAUTION 


Thermal damage will occur if the ET doors 
are not fully latched flush with the orbiter 
body. 


ET Door Operations 


The ET doors are closed post OMS-1 burn after 
MPS vacuum inerting. The doors and latches 
must be sequenced in an orderly manner to 
prevent damage. First, the centerline latches are 
stowed, then the doors are closed, and finally 
the doors are latched. 


The doors are nominally closed by the crew 
with the ET UMBILICAL DOOR switches 
located on panel R2. The MODE switch must be 
in the GPC/MAN position to enable manual 
crew control with the panel R2 switches. 
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Uplock Latch Limit Switches 


The crew stows the centerline latches by taking 
the CENTERLINE LATCH switch to the STOW 
position. Each centerline latch is driven by one 
electromechanical actuator. Nominally, 6 
seconds are required to stow the centerline 
latches with dual motor drive. The GND 
position of this switch removes commands from 
the centerline latch motors. 


The talkback above the CENTERLINE LATCH 
switch has two positions. The microswitches 
that drive the talkback are located within the 
centerline latch drive mechanisms and аге 
activated based on the position of the latches. 
The talkback will be barberpole when the 
latches are deployed or in transit, and will be 
STO when the latches are stowed. 
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Once stowed, the crew cannot redeploy the 
centerline latches. This task can be performed 
only on orbit by real-time commands from 
MCC or postlanding by ground crews. 


The crew uses the LEFT DOOR and RIGHT 
DOOR switches on panel R2 to close the ET 
doors. When the crew positions the switches to 
CLOSE, commands are sent to 
electromechanical actuators to drive the doors 
closed through a system of bellcranks and 
pushrods. Each door has its own actuator and 
will close in approximately 24 seconds with the 
dual motor drive. 


As the doors move within 2 inches of being 
closed, two rollers mounted on the outboard 
edge of each door contact two ready-to-latch 
(RTL) paddles located in the umbilical cavity. 
The two RTL paddles drive three RTL 
microswitches that enable the uplock latch 
motors and drive the CL position of the DOOR 
talkback. Two of the three microswitch 
indications are needed to provide a CL 
indication on the door drive talkback. Each 
door also has two open microswitches that 
drive the OP position of the door talkback. 


The crew uses the LEFT LATCH and RIGHT 
LATCH switches on panel R2 to close the ET 
door uplock latches. When the crew positions 
the switches to LATCH, commands are sent to 
electromechanical actuators that drive the 
uplock latches through a system of pushrods. 
Each set of three uplock latches is driven by one 
actuator. Nominally, it takes 6 seconds to open 
or close the uplock latches with dual motor 
drive. Onboard talkbacks will indicate LAT 
once the uplock latches close. 


When the uplock latches engage the rollers that 
are located on the inside face of the ET door, the 
doors are pulled closed approximately 1 to 2 
inches, providing the 6 psi required to compress 
the aerothermal barrier. Compression of the 
aerothermal barrier results in а seal that 
protects the umbilical cavity from reentry 
heating. 


The RELEASE position of the LEFT and RIGHT 
LATCH switches is used postlanding to open 
the uplock latches in preparation for ET door 
opening. The latch talkbacks indicate REL once 
the uplock latches are fully opened. 
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Ав mentioned previously, the door RTL 
microswitches drive the door CL talkback and 
enable the uplock latch motors. If an ET door 
closes but microswitch failures prevent the 
uplock latches from being enabled, an override 
is available. 


The system is designed so that the LEFT LATCH 
switch can override the right RTL micro- 
switches, and the RIGHT LATCH switch can 
override the left RTL microswitches. Тһе 
override is performed by placing both the LEFT 
LATCH and RIGHT LATCH switches in the 
LATCH position. By doing this, one switch 
overrides the missing microswitch indications, 
enabling the uplock latch motors, while the 
other switch sends its latch command. 


Mission Control has additional telemetry to 
determine if missing RTL indications have pre- 
vented the uplock latches from being enabled. 
The crew should not attempt this override until 
the ground has verified that this is the case. 


During RTLS and TAL aborts, transition into 
MM 602 or 304 will automatically initiate an ET 
door software closure sequence. When the 
sequence starts, GPC commands are sent for 12 
seconds to stow the centerline latches. Six 
seconds from the initial centerline latch 
command, commands are sent to close the ET 
doors. After single motor time for the doors has 
elapsed (48 seconds), close commands are sent to 
the uplock latches for 12 seconds. 


Note that the automatic closure sequence doubles 
the normal drive times on the doors and uplock 
latches, thus allowing for a single motor failure in 
any of the actuators. The sequence does not 
allow single motor drive time on the centerline 
latches before sending the ET door close 
commands. Ё one of the centerline latches does 
have a motor failure, it still should have rotated 
far enough in 6 seconds to disengage the ET 
doors and allow them to close. 


Ihe panel R2 talkbacks remain active 
throughout the software closure sequence; they 
may be used by the flight crew for insight into 
the completion of the sequence. 


During MM 104, 105, and 106, the crew can 
initiate the ET door software closure sequence 
with an item entry on GNC SPEC 51 
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OVERRIDE. However, because the sequence 
sends commands based on times rather than on 
microswitch indications, crew initiation of the 
automatic sequence should only be considered 
as a backup method during an AOA. 


Postlanding, the crew opens the ET umbilical 
doors using the panel R2 switches, which gives 
the ground crews access to the umbilical 
cavities. 


Payload Bay Door System 


The payload bay doors provide an opening for 
payload deployment from and retrieval into the 
payload bay. The doors provide structural 
support for the orbiter midbody, and they 
house the environmental control and life support 
system (ECLSS) radiators that transfer heat from 
the vehicle to space. 


There are two doors, port and starboard. Each 
door consists of five segments interconnected 
by expansion joints. The port door with 
attached systems weighs approximately 2,375 
pounds, and the starboard door weighs about 
2,535 pounds. The starboard door contains the 
centerline latch active mechanisms, which 
accounts for the weight difference. These 
weights do not include the deployable radiator 
system, which adds 833 pounds per door. The 
doors are approximately 60 feet long with a 
combined area of 1,600 square feet. Thermal 
and pressure seals are used to close the gaps at 
the forward and aft fuselage interface, door 
centerline, and expansion joints. The starboard 
door overlaps the port door to form the 
pressure and thermal seal on the centerline. 


The starboard door must be opened first and 
closed last because of the arrangement of the 
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centerline latch mechanism and the structural 
and seal overlap. 


Payload 
bay doors 


Forward Mid 
fuselage fuselage 


| РА 


Payload Вау Doors Location 


Each door is connected to the midfuselage by 13 
hinges; i.e., 5 shear hinges (nonmoving hinges) 
and 8 floating hinges (moving hinges that allow 
for thermal expansion and contraction of the 
doors). Each door is driven open and closed by 
a single electromechanical actuator, each of 
which has two three-phase AC motors. 


Тһе doors are held closed by a total of 32 
latches, 16 centerline latches that secure the 
doors to each other on the centerline and 8 
forward and 8 aft bulkhead latches that secure 
the doors on the bulkheads. 
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Payload Bay Door Latch Locations 


Centerline Latches 


The centerline latches are grouped in four sets 
of four latches each, or four centerline latch 
"gangs." The latches are numbered from 1 to 16, 
starting forward and moving aft. Each latch 
gang is driven by a single typical orbiter 
electromechanical actuator using two three- 
phase AC motors. The motors are reversible, 
which allows the crew to latch or unlatch the 
doors from each other at the centerline. 


The starboard door contains the centerline latch 
hooks, and the port door contains the centerline 
latch rollers. The hooks are the active portion of 
the centerline latch system; they rotate to grasp 
the latch rollers. 
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As the electromechanical actuator torque shaft 
rotates, the bellcrank and link cause the hook to 
rotate closed or open, engaging the latch roller 
on the port door. It takes 20 seconds to open or 
close a gang of centerline latches (dual motor 
time). 


The status of the centerline latch gang is 
provided by limit switches. Two open and two 
closed limit switches are associated with each 
centerline latch gang. These limit switch 
indicators relay the position of the latch gang 
(i.e., latch gang is open or closed). They also 
provide a method for enabling and disabling 
latch drive motors. 
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Payload Bay Door Centerline Latch Actuator Schematic 
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Bulkhead Latches 


The bulkhead latches are grouped in four sets of 
four latches each, comprising the starboard and 
port forward and aft bulkhead latch gangs. 
Each latch gang is driven by a single typical 
electromechanical actuator using two three-phase 
AC motors. The motors are reversible, which 
allows the crew to latch or unlatch the doors from 
the forward and aft bulkheads. The latches are 
numbered 1-4, starting with the latch closest to the 
door hinge line. 


The latch hooks for the bulkhead latches are 
located on the forward and aft edges of each 
door, and the latch rollers are located on the 
forward and aft bulkheads. The hooks are the 
active portion of the bulkhead latch system; 
they rotate to grasp the latch roller. 


PASSIVE ROLLER 


As the electromechanical actuator torque shaft 
rotates, the linkage connecting the latches 
begins to move. The linkage design causes a 
staggered latch open or close sequence; latch 1 
closes first, then latches 2, 3, and 4 close. It 
takes 30 seconds to open or close a group of 
bulkhead latches (dual motor time). The 
staggered sequence results in latch 1 being 
nearly closed as latch 4 is just starting to close. 


The status of the bulkhead latch groups is 
provided by limit switches similar to those used 
by the centerline latches. There are two open 
and two closed limit switches for each bulkhead 
latch gang relay the position of the latch gang 
(i.e, open or closed). They also provide а 
method for enabling or disabling the latch drive 
motors and the payload bay door drive motors. 
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Doors 


Each of the payload bay doors is driven open or 
closed by a single electromechanical actuator 
with two three-phase AC motors per drive unit. 
Torque limiters are incorporated in the rotary 
actuators to avoid damaging the door drive 
motors or mechanisms in the event of jamming 
or binding during operation. It takes 63 
seconds to open or close each door (dual motor 
time). The doors open through an angle of 
175.5°. 


Тһе electromechanical actuator drives а 55-foot- 
long torque shaft that turns the rotary actuators, 
causing the push rods, bellcranks, and links to 
push the doors open. The same arrangement 
pulls the doors closed. 


The push-pull rod is color-coded with silver 
and gold bands to assist the crew in 
determining how far open the door is, since there 
is no telemetry to the ground. As the push rod 
opens or closes the door, certain colors are 
displayed. Each band, gold or silver, represents 
the amount the doors are open or closed in 
degrees of rotation; the distance between stripes 
indicates about 17.5° of motion. The crew can 
use this information to determine if the door is 
warped or jammed by seeing if any push rod 
has more or less stripes visible than the others. 
If the door is completely open, nine colored 
bands should be visible (one gold, six silver, 
and two gold bands; the final silver stripe 
indicating full open is, at best, only partially 
visible to the crew). If the door is completely 
closed, one gold band at the top of the push rod 
should be partially visible. 


There are six push-pull rods per door. They can 
be located by looking along the sill longeron 
that runs along the entire length of the payload 
bay. The pushrod closest to the crew 
compartment is not visible from the aft flight 
deck; to see it, the closed circuit television 
(CCTV) system must be used. 
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The status of the doors is provided by limit 
switches; these, however, are slightly different 
from the centerline latch and bulkhead latch 
limit-switch indicators. Each door has two 
limit-switch modules, one each on the forward 
and aft bulkhead. Each switch module contains 
four limit switches; i.e., three RTL indicators 
and one closed indicator. The RTL indicators 
determine when the door is within 4° of being 
closed. This is important because the forward 
and aft bulkhead latches are then within reach 
to latch the door closed. The closed micro- 
switches indicate when the door is completely 
closed. Each door also has two open limit 
switches located on the torque shaft. These 
limit switches determine when the door drive 
unit has driven to the full open position. 


FULL closed 
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35.5° — : 
а Gold band 
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Push-Pull Rod Markings 
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Payload Bay Door Operations: Opening 


The crew can use either the Auto or Manual 
mode to open the payload bay doors. Both 
sequences are controlled by software. In either 
mode, the crew makes item entries to the PL 
BAY DOORS display, which provides the 
interface between the crew and the doors. The 
display can be called up as PASS SM OPS 202 
(or 402) or as BFS SM SPEC 63. Nominally, the 
doors are opened and closed using PASS in OPS 
202, but when the primary software is not in 
OPS 2, and payload bay door operations are 
needed, the BFS is used. This occurs when the 
doors must be opened early (loss of cooling, for 
example) or when the doors are closed late in 
preparation for entry. Operations in PASS and 
BFS are identical, except for the Warning below, 
which only applies to BFS. In addition, the crew 
uses control switches and talkbacks on panel 
R13L. 


WARNING 


When in BFS, unless specifically directed by 
MCC or Flight Data File procedures, do not go 


back to AUTO mode if mechanisms have been 


commanded in MANUAL mode. There is a 
possibility of driving mechanisms out of order. 


Тһе PL ВАУ DOORS display has 17 manual 
item entries and several columns of status data. 
When selected, Item 1, AC POWER ON, applies 
AC power to the latch and door drives. Item 2, 
AC POWER OFF, removes the AC power. Items 
1 and 2 are mutually exclusive. Item 3, AUTO 
MODE SEL, allows the user to select the Auto 
mode to open and close the doors and latches. 
Items 4 through 13 select a latch or door to 
move manually (listed in the order in which 
they will be performed from the top of the page 
to the bottom for opening the doors, from the 
bottom up for closing the doors). Item 14, PBD 
SW BYPASS, manually bypasses the PL BAY 
DOOR switch on panel R13L in case it has failed 
or if the crew cannot get to the switch for some 
reason; the status of this hardware switch is 
indicated at the top right of the display as the 
PBD-SW status (which will read OP, CL, STOP, 
or FAIL). If the switch is manually bypassed 
with an Item 14, Items 15 through 17 are used to 
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"move" the switch to its various locations. The 
OP/CL status column reflects the state of the 
mechanism, based on how the software 
interprets the microswitch status. The AUTO 
SEQ column shows any Auto Sequence failures. 
Finally, the right side of the display represents 
the microswitches as seen by the software; a 1 
means that the indication "C" (closed) or "O" 
(open) is present, a 0 means it is not present. For 
the latches, two positive indications are 
required for a confirmed state of the latch, 
which is then reflected in the OP/CL column. 
For the doors, a combination of open, closed, 
and RTL indications is required for the software 
to determine the state of the door. 


ЖЕТТЕН PL BAY DOORS а 000/02 :00:00 
000/00: 00 :00 
AC POWER ОМ 1% 
OFF 2 BD SW-@L 
AUTO MODE SEL 3 MICRO-SW STAT 
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MAN|OP/CL|AUTO| ССОО CRRRO 
CENTER ГАТСНЕС |SEL SEQ| АБАВ АВС 
5-8 | 4 | ОР 0011 
9-12 | 5 | ОР 0011 
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АРТ ТАТСНЕЗ| 9 | ОР 0011 00000 
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АРТ ТАТСНЕЗ [12 | CL 1100 11110 
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PL BAY DOORS Display 


An "active group" is that group of items that is 
currently being or are about to be commanded 
to drive. Typically, an active group consists of 
two latch gangs (centerline latches 5-8 and 9-12, 
1-4 and 13-16, starboard bulkhead latches, or 
port bulkhead latches) ог а single door 
(starboard or port). 


The software monitors the latches and door 
drives for premature and _ out-of-sequence 
operation during the Auto mode only (ie. 
making sure that door opening doesn't occur 
before it is unlatched). If any of the latches or 
doors are out of configuration, the Auto mode 
stops, removes AC power to all the payload bay 
door (PLBD) motors, and generates a fault 
message, PBD CONFIG, with an SM ALERT. If 
any latch or door drive exceeds its single-motor 
drive time, the Auto sequence will stop, remove 
AC power to all the PLBD motors, terminate all 


2. SYSTEMS 
2.17 Mechanical Systems 


USA007587 
Rev. A 


drive commands, and generate a fault message, 
PBD SEQ FAIL, with an SM ALERT. These 
safety devices prevent door and latch damage. 


sys 1 
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PL BAY DOORS Controls on Panel R13L 


The PL BAY DOOR SYS 1 and SYS 2 switches 
on panel R13L close DC powered relays that 
allow AC power to reach the motors in the 
electromechanical actuators. The third switch 
on panel R13L used for PLBD operations is the 
PL BAY DOOR switch, which has three 
positions (open, stop, close) to initiate the 
opening and closing sequences. 


The status of the sequence as it proceeds should 
be monitored both on the display and visually 
out the window. Crewmembers should time 
the various mechanism motions to verify dual 
motor time. 


Payload Bay Door Operations: Opening 


Ihe payload bay doors are opened approx- 
imately 1 hour 25 minutes into a nominal flight. 
Certain conditions must be met before the doors 
can be opened. The following table lists the 
failures that will require the crew to leave the 
doors closed and deorbit to the first day 
primary landing site (PLS). 
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If none of these conditions exists, Mission 
Control will give the crew the go-ahead to open 
the doors. The doors and latches must be 
opened in an orderly manner to prevent 
possible damage. Тһе doors and latches are 
normally opened in Auto mode, though they 
may be opened in Manual mode based on crew 
preference, various failures, or as specified by 
the procedures. 
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Opening Doors in Auto Mode 


In Auto mode, the software controls the 
sequence of opening the latches and doors, 
commanding the next group only after the 
previous group has completely moved to its 
end of travel open. 


The crew will first configure the AC and DC 
power sources and select the Auto mode on the 
DPS display. They have no active role in the 
sequence of opening other than to monitor 
times and microswitches and to take manual 
action if a failure occurs. 


First, centerline latch groups 5-8 and 9-12 open. 
These groups secure the mid-centerline region 
of the doors. When the orbiter is exposed to the 
cold environment of space, warping of the 
doors is likely. Opening these two groups first 
relieves the tension in the doors caused by 
thermal expansion and contraction. 


Next to open are centerline latch groups 1-4 and 
13-16, which secure the centerline near the 
forward and aft bulkheads. Opening these 
groups next helps relieve the tension in the door 
caused by thermal warping. Centerline latches 
must be opened before the bulkhead latches to 
decrease tension in the doors. 
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When ай the centerline latches are open, the 
starboard forward and aft bulkhead latches 
open. This removes any tension in the 
starboard door due to the latches and thermal 
warping. The starboard door is then opened. It 
is opened first because it overlaps the port door 
and contains the centerline latch mechanisms. 
The port forward and port aft bulkhead latches 
on the port door are opened next, followed last 
by the port door. 


When OP/CL status of the port door shows OP, 
the PL BAY DOOR switch and the PL BAY 
DOOR SYSTEM switches on panel R13L are set 
to their unpowered positions, item 2 on the DPS 
display (AC POWER OFF) is executed, and the 
payload bay floodlights are turned off. 


Opening Doors in Manual Mode 


The software does not monitor the latch and 
door opening during the Manual mode as it 
does in the Auto mode. The crew must monitor 
the limit-switch indications and motor drive 
times very carefully to determine if the doors 
and latches are opening properly. Any latch or 
door can be driven out of sequence (1.е., the 
bulkhead latches can be opened first). The 
major difference between Auto and Manual 
modes is that in Manual, the crew must select 
which item(s) to drive and then cause the 
mechanism(s) to drive using the switch or 
bypass; in Auto, the software controls which 
items are selected and driven. For nominal 
operations using Manual mode, the sequence of 
the latches and doors matches that of the Auto 
mode. 


Payload Bay Doors: Closing 


The payload bay doors are closed approxi- 
mately 2 hours 45 minutes before the deorbit 
burn. The door closing sequence is the direct 
reverse of the sequence for opening them. The 
port door is closed first, followed by the port 
forward and port aft bulkhead latches. The 
starboard door is closed next, followed by the 
starboard forward and aft bulkhead latches. 
Finally, the centerline latch groups are closed in 
the following order: 1-4 and 13-16, then 5-8 and 
9-12. 


The crew can use Auto or Manual mode to close 
the doors. The difference in monitoring 
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between the two modes is the same as it is to 
open the doors. Panel R13L and the PL BAY 
DOORS display are also used for closing the 
doors. The payload bay doors are normally 
closed using the Auto mode, typically via the 
OPS 202 display in PASS (5M SPEC 63 display 
in BFS). 


Closing Doors in Auto Mode 


To close the doors using the Auto mode, the 
crew configures the AC and DC power sources, 
selects the Auto mode, and then initiates the 
auto sequence by taking the PL BAY DOOR 
switch to CLOSE. The status of the sequence is 
displayed on the DPS display. One manual step 
is taken during the Auto procedures: after the 
port door has been closed and latched, and the 
starboard door is as close as possible to the port 
door before contacting it (about 3-4 feet apart), 
the crew performs a fit check by taking the PL 
BAY DOOR switch to STOP апа visually 
comparing the centerline latches to a diagram. 
The sequence is continued in Auto mode when 
this is verified. When the sequence is complete, 
the PL BAY DOOR switch is set to STOP and the 
AC and DC power sources are removed. 


Closing Doors in Manual Mode 


To close the doors using the Manual mode, the 
crew first configures the AC and DC power 
sources. The manual sequence is initiated by 
selecting the individual mechanism item(s) and 
driving them taking the PL BAY DOOR switch 
to CLOSE, then deselecting the items, and 
proceeding to the next active group. 


First to close are the port door and then the 
bulkhead latches, followed by the starboard 
door. As in the Auto mode, when the starboard 
door is as close as possible to the port door 
before contacting it (approximately 3-4 feet 
apart), the crew performs a fit check by taking 
the PL BAY DOOR switch to STOP and visually 
comparing the centerline latches to a diagram. 
Afterwards, the starboard door is completely 
closed and the bulkhead latches are closed. The 
centerline latches are then closed in the 
following sequence: 1-4 and 13-16, and 5-8 
and 9-12. 


When the last of the latches is closed, the PL 
BAY DOOR switch is set to STOP and the AC 
and DC power sources are removed. 
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Mechanical Systems Summary Data 


2. SYSTEMS 


Orbiter mechanical systems are those 
components that must be deployed, 
stowed, opened, or closed. Each is 
physically moved by an electrical or 
hydraulic actuator. 


АП orbiter electromechanical actuators 
contain two three-phase АС motors, 
brakes, a differential, a gearbox, and limit 
switches. "With the exception of the ET 
door centerline latches, ай actuator 
assemblies also contain torque limiters. 


Power for actuator motors апа limit 
switches is provided by motor control 
assemblies that are controlled by panel 
МА7ЗС. 


The active vent system equalizes the 
unpressurized orbiter compartments and 
controls the orbiter’s internal environment 
by opening and closing vent doors in orbit 
or on the ground. 


The active vent system operates automati- 
cally, except for preentry when the crew 
uses the GNC SPEC 51 OVERRIDE display 
to open or close the vent doors. 


2.17 Mechanical Systems 
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The external tank umbilical doors shield 
the two aft umbilical openings on the 
underside of the orbiter. The doors are 
closed post-OMS 1 burn after MPS vacuum 
inerting. 


ET umbilical doors are controlled by the 
flight crew with switches on panel R2 or 
item entry on the GNC SPEC 51 
OVERRIDE display. 


The payload bay doors provide an opening 
for payload deployment from and retrieval 
into the payload bay. 


Two doors, port апа starboard, are 
connected to the midfuselage. They are 
held closed by groups of centerline and 
bulkhead latches. 


Payload bay doors are opened 
approximately 1 hour 25 minutes into a 
nominal flight and closed about 2 hours 45 
minutes before the deorbit burn. 


Payload bay doors displays and controls 
are on panel R13L and the PL BAY DOORS 
display. 
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Mechanical Systems Rules of Thumb 


Always use a timer when operating mechanical 
systems, noting either dual or single motor time. 
Do not continue to command driving if greater 
than the single motor time has elapsed without 
the mechanism reaching the desired state. 
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OMS Rules of Thumb 


Description 


The OMS provides propulsion for the orbiter 
during the orbit phase of flight. The OMS is 
used for orbit insertion, orbit circularization, 
orbit transfer, rendezvous, and deorbit. It may 
provide thrust above 70,000 feet altitude. Each 
OMS pod can provide more than 1,000 pounds 
of propellant to the RCS. Amounts available for 
interconnect depend on loading and number of 
OMS starts during the mission. 


The OMS is housed in two independent pods on 
each side of the orbiter’s aft fuselage. The pods, 
which also house the aft reaction control system 
(RCS), are referred to as the OMS/RCS pods. 
Each pod contains one OMS engine and the 
hardware needed to pressurize, store, and 
distribute the propellants to perform OMS 
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engine burns. Normally, OMS maneuvers are 
done using both OMS engines together; 
however, a burn can be performed using only 
one OMS engines. For velocity changes less 
than 6 fps, RCS is used. For velocity changes 
greater than 6 fps, a single OMS engine burn is 
preferred, because engine lifetime concerns 
make it desirable to minimize engine starts. 
Two OMS engines are used for large velocity 
changes or for critical burns. Propellant from 
one pod can be fed to the engine in the other 
pod through crossfeed lines that connect the left 
and right OMS pods. 


The OMS has important interfaces with the data 
processing system and the electrical power 
system. The OMS valves and gimbal actuators 
receive commands, and the system returns 
some data to the GPCs through multiplexer/ 
demultiplexer units. Electrical power is 
supplied to the OMS through main buses, 
control buses, and alternating current buses to 
operate switches, valves, instrumentation, 
gimbal actuators, and heaters. 


The OMS/RCS pods are designed to be reused 
for up to 100 missions with only minor repair, 
refurbishment, and maintenance. The pods are 
removable to facilitate orbiter turnaround, 
if required. 


NOTE 


At one time, there were plans to provide 
additional capability by including an OMS 
kit. It is now unlikely that OMS kits will 
ever be used, but OMS kit switches and 
gauges appear throughout the orbiter. 
They currently are inoperative and are 
likely to remain so. 


OMS engina 


OMS helium tank 


OMS oxidizer tank 
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Items 1 through 4 (OMS BOTH, L, R, and RCS 
SEL) are used to select both OMS engines, one 
engine, or RCS jets for an OMS burn and are 
mutually exclusive item entries. This informa- 
tion is used by guidance and the OMS software. 


Item 5 (TV ROLL) is the roll attitude for OMS 
burns. Normally, it is 180°, corresponding to a 
heads-down attitude. A different number can 
be entered in MM 202 only, but is seldom 
changed. 


Items 6 through 8 (TRIM LOAD P, LY, RY) are 
used to enter gimbal trim angles for OMS burns. 


Item 9 (WT) is the current weight of the orbiter 
in pounds, which is computed and used by 
guidance. It can be changed when a more accu- 
rate weight is known. 


Item 10 (TIG) is the time of ignition for an OMS 
burn in days/hours:minutes:seconds of mission 
elapsed time (MET). It is entered as part of a 
burn target. 


Target parameters for powered explicit guid- 
ance (TGT PEG 4) are entered with items 14 to 
18. PEG 4 guidance puts the orbiter on course 
for a specific point in space and is normally 
used for OMS 1, OMS 2, and deorbit burns. 
PEG 4 targets are only used in OPS 1 and 3. 


Items 19 to 21 (ТСТ PEG 7) are where the target 
parameters are entered for another type of 
guidance, known as PEG 7 or External AV 
guidance. It is used to add or subtract orbital 
velocity and does not target the vehicle for a 
specific point in space. PEG 7 targets can be 
used in OPS 1, 2, or 3. PEG 7 delta velocities are 
in the LVLH coordinate frame. 
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Executing item 22 (LOAD) causes guidance to 
compute a burn solution on the basis of the tar- 
get parameters that have been entered under 
PEG 4 or PEG 7. Executing item 23 (TIMER) 
sets up a timer that counts down to time of 
ignition and is displayed on the second line at 
the upper right corner of the display. 


Items 24 through 26 (BURN ATT) are the 
desired inertial attitude for the OMS burn, 
which guidance computes as part of the burn 
solution. Executing item 27 (MNVR) causes an 
automatic maneuver to this attitude. 


The ТТС field displays the time to attitude in 
the current DAP. When in attitude the “mm:ss” 
field will blank. If the "in-attitude" time is less 
than TIG -30 seconds (and not in attitude), 
mmxss will be displayed over bright. The fields 
next to the ITEM 27 display the current DAP 
mode (AUTO, INRTL, LVLH or FREE). 


The GMBL L, R items on the display are the 
actual gimbal position angles. Items 28 through 
33 (РКІ, SEC, OFF) permit selection of primary 
or secondary gimbal motors or turn off both 
gimbal motors. 


Executing item 34 (GMBL CK) starts an auto- 
matic gimbal check sequence. 


The EXEC item flashes on the screen 15 seconds 
before TIG; it remains there until the EXEC key 
is depressed, which enables OMS burn ignition. 


AV TOT is the total change in velocity needed to 
satisfy the target requirements. ТСО is the 
expected duration of the burn. Below that are 
the X, Y, and Z components of AV TOT. АП of 
this is computed by Guidance when a target is 
loaded. These delta velocities are in the body 
axis coordinate frame. 


ТСТ HA and HP are the altitudes in nautical 
miles (n. mi.) of the apogee and perigee for the 
orbit that will result from the successful 
completion of the targeted OMS burn. CUR HA 
and HP are the current apogee and perigee 
altitudes. Mileages are from the Earth's surface. 


Item 35 (ABORT TGT) permits entry of a stored 
PEG 4 target for OMS 1 or OMS 2 with a single 
keystroke. It is used primarily for calling up 
ATO and AOA targets. 
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Flight software is divided into operational 
sequences (OPS) that are subdivided into major 
modes (MMs). Operational sequences and 
major modes are discussed in detail in Section 
2.6; however, it should be noted that OMS 
burns can only be performed in MM 104, 105, 
202, and 302. OMS dumps can be performed in 
MM 102, 103, 304, 601, and 602. 


The maneuver (MNVR) display appears 
automatically in MM 104, 105, 106, 202, 301, 302, 
and 303. The title has a prefix and a suffix that 
vary according to major mode. The BFS version 
of the display is identical to the primary 
display. 


OMS 1 MNVR EXEC 
OMS 2 MNVR EXEC 
OMS 2 MNVR COAST 


OMS 1 burn 
OMS 1 burn 
Post-OMS 2 coast 
Orbital maneuvers 
Pre-deorbit coast 
Deorbit burn 
Pre-deorbit coast 


ORBIT MNVR EXEC 
DEORB MNVR COAST 
DEORB MNVR EXEC 
DEORB MNVR COAST 


Maneuver Display Titles Associated with 
Major Mode 


Engines 


The OMS engines are designated left and right, 
descriptive of location. The engines are located 
in gimbal mounts that allow the engine to pivot 
left and right (yaw) and up and down (pitch) 
under the control of two electromechanical 
actuators. This gimbal system provides for 
vehicle steering during OMS burns by 
controlling the direction of the engine thrust in 
pitch and yaw (thrust vector control) in 
response to commands from the digital 
autopilot or from the manual controls. 


The OMS engines can be used singularly by 
directing the thrust vector through the orbiter 
center of gravity or together by directing the 
thrust vector of both engines parallel to the X 
axis. During a two-OMS-engine burn, the RCS 
will come into operation only if the attitude or 
attitude rate limits are exceeded. However, 
during a one-OMS-engine burn, RCS roll 
control is required. Section 2.22 has more 
information about the RCS and its interaction 
with the OMS. 


Each of the two OMS engines produces 6,087 
pounds of thrust. For a typical orbiter weight, 
both engines together create an acceleration of 
approximately 2 ft/sec? or 0.06 g's. Using up a 
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fully loaded tank, the OMS can provide a total 
velocity change of approximately 1,000 ft/sec. 
Orbital insertion burns and deorbit burns each 
typically require a velocity change of about 100- 
500 ft/sec. The velocity change required for 
orbital adjustment is approximately 2 ft/sec for 
each nautical mile of altitude change. 


Each OMS engine is capable of 1,000 starts and 
15 hours of cumulative firing. The minimum 
duration of an OMS engine firing is 2 seconds. 


The OMS engines use monomethyl hydrazine 
as the fuel and nitrogen tetroxide as the 
oxidizer. These propellants are hypergolic, 
which means that they ignite when they come 
in contact with each other; therefore, no ignition 
device is needed. Both propellants remain 
liquid at the temperatures normally experienced 
during a mission, however, electrical heaters are 
located throughout the OMS pods to prevent 
any freezing of propellants during long periods 
in orbit when the system is not in use. 


Each OMS engine has a gaseous nitrogen tank 
that provides pressurized nitrogen to operate 
the engine valves. The OMS engine does not 
have propellant pumps; propellant flow to the 
engines is maintained by pressurizing the 
propellant tanks with helium. 


In the OMS engine, fuel is burned with oxidizer 
to produce thrust. The major elements of the 
OMS engine are the bipropellant valve 
assembly, the injector plate, the thrust chamber, 
and the nozzle. 


Bipropellant Valve Assembly 


Each OMS engine receives  pressure-fed 
propellants at a bipropellant valve assembly, 
which regulates the flow of propellants to the 
engine to start and stop engine burns. The 
valve assembly consists of two fuel valves in 
series and two oxidizer valves in series. Having 
two valves in series for each propellant 
provides redundant protection against leakage, 
but it also means that both valves must open to 
allow propellant flow to the engine. 


Each fuel valve is mechanically linked to an 
oxidizer valve so that they open and close 
together. The name bipropellant valve means 
that each linked set of valves controls the flow 
of both propellants. 
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Orbital Maneuvering System Engine 


The bipropellant valves are ball valves that 
rotate from fully closed (0 percent) to fully open 
(100 percent). The crew can read the valve 
position in percent for each set on the GNC SYS 
SUMM 2 display. The VLV 1 and 2 position 
indicators on the display should read 
approximately 100 percent for both valve 1 and 
valve 2 at the start of an OMS burn and remain 
there throughout the burn. If the valve position 
is less than 70 percent for either valve, there will 
probably be insufficient propellant flow, and 
ignition may not occur. Also, ignition may 
occur with the possibility of engine hard start or 
combustion instability resulting in structural 
failure and/or chamber burnthrough. 


Тһе bipropellant valves are driven open and 
closed by pneumatic pistons. There is one piston 
for each set of bipropellant valves. The pistons 
are normally held in the closed position by 
springs. Pressurized nitrogen is used to fill the 
piston, which then mechanically opens the 
bipropellant valves. The engine control valves 
regulate the flow of nitrogen to the pistons and 
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thereby control the opening and closing of the 
bipropellant valves. The engine control valve is a 
solenoid valve that responds to commands from 
the GPCs. Both engine control valves must 
operate in order for the bipropellant valves to 
open. 


The engine control valves are discussed in more 
detail in the next section on the nitrogen system. 


Injector Plate 


After passing through the bipropellant valves, 
the oxidizer line runs directly to the engine 
injector plate. The fuel, however, is used to cool 
the engine, and so it is routed through a cooling 
jacket around the thrust chamber before it 
reaches the injector plate. A temperature sensor 
is located near the fuel inlet to the injector, and 
the reading from this sensor can be viewed by 
the crew in the FU INJ T entry on the BFS GNC 
SYS SUMM 2 display. This parameter does not 
appear on the PASS GNC SYS SUMM 2 display, 
but can be found on SM SPEC 89 PRPLT 
THERMAL in OPS 2. 
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OMS Parameters on SM SPEC 89 PRPLT THERMAL Display 


Since the fuel injector temperature is the 
temperature of the fuel after it has passed 
through the chamber cooling jacket, it provides 
an indirect indication of the temperature of the 
thrust chamber walls. А high fuel injector 
temperature indicates that the engine may be 
sustaining thermal damage. The fuel normally 
flows to the engine at a temperature between 
30? and 125? F. During engine operation, when 
the fuel is cooling the chamber, the fuel injector 
temperature should be approximately 218? F. 
The temperature limit for safe operation is 260? F. 


Thrust Chamber 


The fuel and oxidizer are mixed at the injector 
plate in the thrust chamber. When the fuel 
reaches the thrust chamber, it is directed 
through 120 cooling channels in the combustion 
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chamber walls, providing regenerative cooling 
to the combustion chamber walls, and then to 
the injector of the engine. The oxidizer is routed 
directly to the injector. 


The fuel and oxidizer orifices are positioned so 
that the propellants will impinge and atomize, 
causing the fuel and oxidizer to ignite because 
of hypergolic reaction. The resulting hot gas 
creates thrust as it exits the chamber and 
expands through the engine nozzle. The 
contoured nozzle extension is bolted to the aft 
flange of the combustion chamber. 


The pressure in the thrust chamber (Ре) is meas- 
ured by a sensor that is wired directly to the 
OMS P. meter on the MEDS MPS/OMS display. 
The meter is calibrated in percent. The normal 
P. during a burn is between 100 and 105 
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percent, which corresponds to a pressure of 
approximately 131 psia. For an off-scale high 
condition, the MEDS OMS Pc meter will display 
the maximum (160) value in the digital box in 
red with an empty red box for the tape. For an 
off-scale low condition, the minimum (0) value 
will be displayed instead. For Analog Digital 
Converter (ADC) failures, the display 15 
blanked with an empty red box. The LEFT or 
RIGHT OMS red caution and warning light on 
panel F7 will illuminate if Р, is less than 80 
percent when the engine should be on, or 
greater than 80 percent when the engine should 
be off. 
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OMS Рс N2 and He TANK Meters on the 
MEDS MPS/OMS Display 


Pressure sensors in the fuel and oxidizer lines 
are located just above the bipropellant valves. 
These inlet pressures for each engine are shown 
on the GNC SYS SUMM 2 display as ENG IN P, 
one for oxidizer, one for fuel. When the OMS 
engines are not burning, the inlet pressures 
should match the propellant tank pressures, 
which are normally 254 psi During OMS 
burns, propellant flow into the thrust chamber 
causes the inlet pressure to Ягор to 
approximately 220 to 235 psi for the fuel and to 
200 to 206 psi for the oxidizer, but the 
propellant tank pressures remain higher. The 
exact inlet pressures are engine dependent. 
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The inlet pressures are an indirect indication of 
propellant flow rates. If they are abnormal, 
problems should be anticipated. An imbalance 
in the flow rates for fuel and oxidizer will result 
in an incorrect mixture ratio in the thrust 
chamber. If the mixture becomes fuel-rich, the 
chamber pressure and temperature will 
decrease, and combustion will eventually be 
choked off. If the mixture becomes fuel-lean, 
the chamber temperature will increase, and 
engine damage could result. If the fuel-lean 
condition is the result of a low fuel flow rate, 
the situation is especially serious, since the fuel 
is used to cool the outside of the thrust 
chamber. 


Nitrogen System 


Gaseous nitrogen is used to operate the engine 
control valves and also to purge the fuel lines at 
the end of each burn. The nitrogen system con- 
sists of a storage tank, engine pressure isolation 
valve, regulator, relief valve, check valve, accu- 
mulator, engine purge valves, bipropellant 
solenoid control valves, and actuators that 
control the bipropellant ball valves. 


A spherical gaseous nitrogen storage tank is 
mounted next to the combustion chamber in 
each of the two engines to supply pressure to its 
engine pressure isolation valve. The tank 
contains enough nitrogen to operate the ball 
valves and purge the engine 10 times. 


Two sensors monitor each tank's pressure. One 
sensor displays the tank pressure on the MEDS 
MPS/ OMS display. The other sensor displays 
the tank pressure on the GNC SYS SUMM 2 
display. Both pressures are downlisted by 
telemetry. 


A dual-coil, solenoid-operated nitrogen pres- 
sure isolation valve (sometimes called the en- 
gine pressure valve) is located in each gaseous 
nitrogen system. The valve is energized open 
and spring-loaded closed. It must be open for 
nitrogen to reach the OMS engines. The valve 
permits gaseous nitrogen flow from the tank to 
the regulator, accumulator, bipropellant ball 
valve control valves, and purge valves 1 and 2 
when energized open and isolates the nitrogen 
tank from the gaseous nitrogen supply system 
when closed. 
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The nitrogen pressure valves іп each system аге 
controlled by the OMS ENG LEFT, RIGHT 
switches on panel C3. Placing the switch in the 
ARM/PRESS position opens the nitrogen 
pressure valve. The switch is placed in the 
ARM/PRESS position by the crew before each 
OMS burn and is left in the OFF position at all 
other times. When one of the OMS ENG 
switches is placed in the ARM/PRESS position, 
the respective OMS engine pod's pressure 
isolation valve is energized open. When the 
switches are in any other position (ARM or 
OFF), the valve remains closed. 


The gaseous nitrogen engine pressure isolation 
valve, when energized open, allows gaseous 
nitrogen supply pressure to be directed into a 
regulator, through a check valve and an in-line 
accumulator, and to a pair of valves. The status of 
the nitrogen pressure valve can be seen on the 
GNC SYS SUMM 2 display: the РУГУ parameter 
reads OP for open and CL for closed. When the 
position of the OMS ENG switch on panel C3 is 
changed, the display should be checked to see 
that the valve is in the proper position. 


Pressure 
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Nitrogen System 


A single-stage regulator is installed in each 
gaseous nitrogen pneumatic control system 
between the gaseous nitrogen engine pressure 
isolation valve and the engine bipropellant 
control valves. The regulator reduces nitrogen 
pressure from its tank pressure, which can be as 
high as 3,000 psig, to a desired working 
pressure of 315 to 360 psig. A pressure sensor 
downstream of the regulator monitors the 
regulated pressure and transmits it to telemetry 
and to the GNC SYS SUMM 2 display (REG P). 


A pressure relief valve downstream of the 
regulator limits the pressure to the engine 
bipropellant control valves and actuators if a 
regulator malfunctions. The relief valve opens 
between 450 and 500 psig and reseats at 400 
psig minimum. 


The check valve located downstream of the 
regulator will close if gaseous nitrogen pressure is 
lost on the upstream side of the check valve and 
will isolate the remaining gaseous nitrogen 
pressure on the downstream side of the check 
valve. 


Тһе 19-cubic-inch gaseous nitrogen (СМ) 
accumulator downstream of the check valve 
and upstream of the bipropellant control valves 
provides enough pressure to operate the engine 
bipropellant control valves at least one time 
with the engine pressure isolation valve closed 
(ARM position), or in the event of loss of 
pressure on the upstream side of the check 
valve. The accumulator is protected from 
upstream leaks by the one-way check valve. 
From the accumulator, the nitrogen flows to the 
engine control valves where it can be used to 
operate the bipropellant valve pistons. 


Two solenoid-operated control valves on each 
OMS engine allow nitrogen to control the 
bipropellant control valve actuators and 
bipropellant ball valves. Control valve 1 
controls the no. 1 actuator and the first set of 
fuel and oxidizer ball valves. Control valve 2 
controls the no. 2 actuator and the second set of 
fuel and oxidizer ball valves, in series with the 
no. 1 system. Each control valve contains two 
solenoid coils, either of which, when energized, 
opens the control valve. 
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OMS ENG Switches on Panel C3 


The right OMS engine GN» solenoid control 
valves 1 and 2 are energized open by computer 
commands if the OMS ENG RIGHT switch on 
panel C3 is in the ARM or ARM/PRESS position 
and the R OMS ENG VLV switch in the bottom 
row on panel O16 is ON; the valves are de- 
energized normally when the thrust is 
commanded off or if the OMS ENG RIGHT 
switch on panel C3 is positioned to OFF. The 
left OMS engine GN» solenoid control valves 1 
and 2 are controlled in the same manner, using 
the OMS ENG LEFT switch on panel C3 and the 
L OMS ENG VLV switch in the bottom row on 
panel O14. 


Check valves are installed in the vent port 
outlet of each GN? solenoid control valve on the 
spring pressure side of each actuator to protect 
the seal of these from atmospheric 
contamination. 


Ball Valve Actuation 


When the СМ; solenoid control valves аге 
energized open, pressure is directed into the 
two actuators in each engine. The nitrogen acts 
against the piston in each actuator, overcoming 
the spring force on the opposite side of the 
actuators. Each actuator has a rack-and-pinion 
gear; the linear motion of the actuator 
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connecting arm is converted into rotary motion, 
which drives two ball valves, one fuel and one 
oxidizer, to the open position. Each pair of ball 
valves opens simultaneously. Fuel and oxidizer 
are then directed to the combustion chamber of 
the engine, where the propellants atomize and 
ignite upon contact. 


When the computer commands thrust off, or 
when an engine’s OMS ENG switch on panel C3 
or the L or R OMS ENG VLV switch on panel 
014/016 is positioned OFF, the solenoid 
control valves are de-energized, removing GN» 
pressure from the actuators. The GN? pressure 
in the actuators is vented overboard through the 
solenoid control valve. The spring in the actu- 
ator forces the actuator's piston to move in the 
Opposite direction, and the actuator drives the 
fuel and oxidizer ball valves closed simul- 
taneously. The series-redundant arrangement 
of ball valves ensures engine burn is terminated. 
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OMS Purge 


The nitrogen subsystem also purges the fuel 
lines following OMS burns. After an OMS 
burn, some fuel and oxidizer will be left in the 
engine inlet lines and will be subject to cold 
temperatures. The oxidizer does not present a 
problem, but the fuel could freeze, especially in 
the cooling jacket around the thrust chamber. 
The frozen fuel will eventually sublimate. But 
for the first 10 minutes or so following a burn, it 
might be dangerous to start another burn, since 
forcing more fuel into already frozen lines could 
cause damage. 


This situation is avoided by forcing nitrogen 
through the fuel lines immediately after the 
engine shuts down. This purge is part of the 
automatic OMS burn sequence and takes about 
2 seconds. When a burn ends, the control 
valves close, and the purge valves open. 
Nitrogen can then flow into the fuel line below 
the bipropellant valves where it forces the 
remaining fuel through the inlet lines and 
cooling jacket and out through the engine. 


Each engine has two gaseous nitrogen purge 
valves in series. These valves are solenoid- 
operated open and spring-loaded closed. They 
are normally energized open by the GPCs after 
each burn unless the purge is inhibited by 
having the OMS ENGINE switches on panel C3 
in ARM. The two purge valves of an engine are 
energized open 0.36 second after OMS engine 
thrust has been commanded off. Opening the 
purge valves permits gaseous nitrogen to flow 
through the valves and check valve into the fuel 
line downstream of the ball valves. It then 
flows out through the combustion chamber and 
engine injector to space for 2 seconds. This 
purges the residual fuel from the combustion 
chamber and injector of the engine, permitting 
safe engine restart. The purge valves are then 
de-energized and spring-loaded closed. When 
the purge is completed, the gaseous nitrogen 
tank pressure isolation valve is closed by 
placing the respective OMS ENG switch on 
panel C3 to OFF. The check valve downstream 
of the purge valves prevents fuel from flowing 
to the engine purge valves during engine burns. 


The automatic software will perform the purge 
only if the OMS ENG switch on panel C3 is in 
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the ARM/PRESS position; that is, when the 
nitrogen pressure valve is open. For that 
reason, the crew should leave both OMS ENG 
switches in ARM/PRESS for at least 2 seconds 
after an OMS burn so that the purge can be 
completed. When the nitrogen pressure valve is 
open, nitrogen for the purge is supplied by the 
tank. If the valve were closed, the purge would 
deplete the accumulator, and the OMS start 
capability of the accumulator would be lost. 
This is not normally a problem since the 
accumulator can be repressurized. But if the 
valve were closed because of an upstream leak, 
it would be important to save the nitrogen in 
the accumulator. The purge is not as important 
as the need to preserve the engine restart 
capability. With the OMS ENG switch in ARM 
or OFF, the valve is closed, and the engine 
purge is automatically inhibited. 


Helium System 


Each OMS pod helium pressurization system 
consists of a high-pressure gaseous helium 
storage tank, two helium pressure isolation 
valves, two dual pressure regulator assemblies, 
parallel vapor isolation valves on the regulated 
helium pressure to the oxidizer tank only, dual 
series-parallel check valve assemblies, and 
pressure relief valves. 


Helium Tanks 


Oxidizer and fuel are supplied to each OMS 
engine by separate sets of propellant tanks. The 
OMS engine does not have fuel or oxidizer 
pumps; propellant flow must be maintained by 
keeping the tanks pressurized with helium. A 
single helium tank provides pressurization to 
both fuel and oxidizer tanks. One advantage to 
having a single helium tank in each pod is that 
it helps ensure that the two propellant tanks 
remain at the same pressure and thus avoids 
incorrect mixture ratios. The helium tank’s 
operating pressure range is 4,800 to 390 psia. 


Two pressure sensors downstream of each 
helium tank in each pod monitor the helium 
source pressure. One sensor displays the 
pressure on the MEDS MPS/OMS display. The 
reading from the other sensor appears on the 
GNC SYS SUMM 2 display (OMS TK P HE). 
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Propellant and Helium Supply 


NOTE 


Below a certain propellant quantity, there 
is enough residual helium pressure in the 
propellant tank to effectively use all the 
propellant in that tank. This quantity is 
referred to as “max blowdown.” Max 
blowdown for an OMS tank is 
approximately 39 percent. 


Helium Pressure Valves 


Two helium pressure valves in each pod isolate 
the helium tank from the propellant tanks. The 
valves are in a parallel arrangement, and are 
labeled A and B. This arrangement provides 
redundant paths for the helium to reach the 
propellant tanks. These valves are held closed by 
springs and are opened by electrical solenoids. 


2. SYSTEMS 
2.18 Orbital Maneuvering System (OMS) 


The valves are controlled by the LEFT and 
RIGHT OMS He PRESS/VAPOR ISOL switches 
on panel O8. The switches have manual OPEN 
and CLOSE positions as well as a GPC position 
that allows automatic control. These valves are 
normally closed at all times except during OMS 
burns. If the switches are in the GPC position, 
the automatic OMS burn sequence opens the 
helium pressure valves at the start of a burn and 
closes them at the end of a burn. 


NOTE 


When manually opening the He 
PRESS/VAPOR ISOL switches, delay 2 
seconds between opening the A and B 
valves. This will prevent a possible water 
hammer effect due to a large and sudden 
pressure change. 
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Helium Pressure Regulators 


Below each helium pressure valve is a pressure 
regulator that reduces the helium source 
pressure from its value in the tank, which can 
be as high as 4,800 psi (at launch), to the desired 
working pressure of approximately 250 psig. 
Each pressure regulator assembly contains a 
flow limiter and primary and secondary 
regulators in series. Normally, the primary 
regulator is the controlling regulator. Should 
the primary regulator fail, the secondary one 
will continue to provide pressure control. 


The primary regulator pressure at normal flow 
is 252 to 262 psig, while the secondary regulator 
pressure at normal flow is 259 to 269 psig. 
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Vapor Isolation Valves 


Over a long period of time, it is possible for 
small amounts of propellant vapors to diffuse 
through the check valves and into the helium 
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lines. The vapor isolation valves in the helium 
pressurization line to the oxidizer tank prevent 
oxidizer vapor from migrating upstream and 
over into the fuel system, causing a hypergolic 
reaction. The vapor isolation valves are low- 
pressure,  two-position, solenoid-operated 
valves that are energized open and spring- 
loaded closed. They can be commanded by the 
positioning of the LEFT and RIGHT OMS He 
PRESS/VAPOR ISOL switches on panel O8. 
When either the A or B switch is in the OPEN 
position, both vapor isolation valves are 
energized open; when both switches are in the 
CLOSE position, both vapor isolation valves are 
closed. When the switches are in the GPC 
position, the GPC opens and closes the valves 
automatically. 


Check Valves 


The check valve assembly contains four 
independent check valves connected in a series- 
parallel configuration to provide a positive 
checking action against a reverse flow of 
propellant liquid or vapor. The parallel path 
permits redundant paths of helium to the 
propellant tanks, while the series arrangement 
provides redundant backflow protection. 
Filters are incorporated into the inlet of each 
check valve assembly. 


Relief Valves 


Below the check valves are the relief valves that 
protect the propellant tanks from over pressuri- 
zation. Each pressure relief valve contains a 
burst diaphragm and filter. If excessive pres- 
sure is caused by helium or propellant vapor, 
the diaphragm will rupture, and the relief valve 
will open and vent the excessive pressure over- 
board. The filter prevents particulates from the 
non-fragmentation-type diaphragm from 
entering the relief valve seat. The relief valve 
will close and reseat after the pressure has re- 
turned to the operating level. The burst 
diaphragm is used to provide a more positive 
seal of helium and propellant vapors than the 
relief valve. The diaphragm ruptures between 
303 and 313 psig, while the relief valve opens at 
286 psig and reseats at 280 psig. 


2. SYSTEMS 
2.18 Orbital Maneuvering System (OMS) 


USA007587 
Rev. A 


Propellant Storage and Distribution 


The OMS propellant storage and distribution 
system consists of one fuel tank and one 
oxidizer tank in each pod. It also contains 
propellant feed lines, crossfeed lines, isolation 
valves, and crossfeed valves. The OMS 
propellant in both pods enables the orbiter to 
perform a 1,000-foot-per-second velocity change 
with a 65,000-pound payload in the payload 
bay. The OMS pod crossfeed lines allow the 
propellants in the pods to be used to operate 
either OMS engine. 


Fuel (monomethyl hydrazine) and oxidizer 
(nitrogen tetroxide) are stored in domed 
cylindrical titanium tanks within each pod. The 
propellant tanks, which are pressurized by the 
helium system, are divided into forward and aft 
compartments. Each tank contains a propellant 


acquisition and retention assembly in the aft 
end. This assembly consists of a mesh screen 
dividing the fore and aft compartments and an 
acquisition system. Surface tension created by 
the screen retains propellant in the aft 
compartment during zero-gravity conditions. 


The acquisition assembly consists of four stub 
galleries and a collector manifold. The stub 
galleries acquire wall-bound propellant at OMS 
start and during RCS burns to prevent gas 
ingestion. The stub galleries have screens that 
allow propellant flow and prevent gas 
ingestion. The collector manifold is connected 
to the stub galleries and also contains a gas 
arrestor screen to further prevent gas ingestion, 
which permits OMS engine ignition without the 
need of а propellant-settling maneuver 
employing RCS engines. The propellant tank’s 
nominal operating pressure is 250 psi, with a 
maximum operating pressure limit of 313 psia. 
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Each propellant tank has one pressure sensor 
wired directly to the RCS/OMS/PRESS meters 
on panel O3. Selecting the OMS PRPLT 
position of the rotary switch below the bank of 
meters enables the crew to read fuel and 
oxidizer tank pressures. The same 
measurement is also displayed on the GNC SYS 
SUMM 2 display (TK P OXID, FU entries). If 
the tank pressure is lower than 232 psia or 
higher than 284 psia, the LEFT or RIGHT OMS 
red caution and warning light on panel F7 will 
be illuminated. 


OMS Quantity Gauging 


A capacitance gauging system in each OMS 
propellant tank measures the propellant in the 
tank. The system consists of a forward and aft 
probe and a totalizer. The fluid in the area of 
the communication screens cannot be measured 
and is called the "ungaugeable region." 


The totalizer receives OMS valve operation 
information and inputs from the forward and 
aft probes in each tank and outputs total and aft 
quantities and a low level quantity. The inputs 
from the OMS valves allow control logic in the 
totalizer to determine when an OMS engine is 
burning and which tanks are being used. The 
totalizer begins an engine flow rate/time 
integration process at the start of the OMS burn, 
which reduces the indicated amount of 
propellants by a preset estimated rate for the 
first 14.8 seconds. After 14.8 seconds of OMS 
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burn, which settles the propellant surface, the 
probe capacitance gauging system outputs are 
enabled, which permits the quantity of 
propellant remaining to be displayed. The 
totalizer outputs are displayed оп the 
RCS/OMS PRPLT QTY LEDs on panel ОЗ 
when the rotary switch below the LEDs is 
positioned to the OMS FUEL or OXID position. 
In addition, the GNC SYS SUMM 2 display has 
a readout of the aft probe quantity (OMS AFT 
QTY). Quantity gauging is updated when at 
least one OMS engine is burning. 


When the forward probe is dry (quantity 
approximately 45 percent), the ungaugeable 
propellant in the region of the intermediate 
bulkhead is added to the aft probe output 
quantity, decreasing the total quantity at a 
preset rate for 108 seconds, and updates from 
the aft probes are inhibited. After 108 seconds 
of burning (quantity approximately 30 percent), 
the aft probe output inhibit is removed, and the 
aft probe updates the total quantity. When the 
quantity decreases to 5 percent, the low-level 
signal is output. 


NOTE 


Erroneous temperature and/or pressure 
transducer readings will cause erroneous 
propellant quantity calculations. 
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2.18 Orbital Maneuvering System (OMS) 


Tank Isolation Valves 


Parallel tank isolation valves (A and B) are 
located in each pod between the propellant 
tanks and the OMS engine and the OMS 
crossfeed valves and permit propellant to be 
isolated from the rest of the downstream 
systems. The valves are driven open and closed 
by ac motors that normally use three-phase ac 
power but can operate on two-phase power. 


The LEFT and RIGHT OMS TANK ISOLATION 
A switches on panel O8 control the A fuel and A 
oxidizer valve in that pod, and the B switches 
control the B fuel and B oxidizer valve in that 
pod. The switches have manual OPEN and 
CLOSE positions and a GPC position that 
enables automatic control of the valves. When 
the LEFT or RIGHT OMS TANK ISOLATION 
switches in a pod are positioned to GPC, valves 
are automatically opened or closed upon 
command from the orbiter computer. When a 
pair of valves is opened, fuel and oxidizer from 
the propellant tanks are allowed to flow to that 
OMS engine and OMS crossfeed valves. 


The switch positions OPEN, GPC, and CLOSE 
аге permanent-position switches. Electrical 
power is provided to an electrical motor 
controller assembly, which supplies power to 
the ac-motor-operated valve actuators. Once 
the valve is in the commanded position, logic in 
the motor controller assembly removes power 
from the ac-motor-operated valve actuator. A 
talkback indicator above each LEFT or RIGHT 
OMS TANK ISOLATION switch on panel O8 
indicates the status of the fuel valve and 
oxidizer valve. The talkback indicator is 
controlled by microswitches in each pair of 
valves. The talkback indicator indicates OP 
when that pair of valves is open, barberpole 
when the valves are in transit or one valve is 
open or closed, and CL when that pair of valves 
is closed. 


Crossfeeds and Interconnects 


An OMS engine in one pod may be fed with 
propellant from the other pod. This is called an 
OMS crossfeed and would be done to balance 
the propellant weight in each pod or in 
situations where an OMS engine or a propellant 
tank had failed. 
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Crossfeed lines connect the left and right OMS 
propellant lines at a point between the tank 
isolation valves and the bipropellant valves. 
Each crossfeed line has two crossfeed valves 
arranged in parallel to provide redundant paths 
for propellant flow. The LEFT and RIGHT OMS 
CROSSFEED switches are on panel O8, апа 
each controls a pair of fuel and oxidizer valves 
in the crossfeed lines. 


г-- OMS KIT——4 г--1ЕРТ OMS —4 [= RIGHT OMS —4 
өр, $ 


r 1 r 1 
He PRESS/VAPOR 1501. He PRESS/VAPOR ISOL 
А В| А 8| 


ГС 


(512) 1513) (515) 


г 1 
He PRESS/VAPOR ISOL 
n В| 


ОР 


(05121 (05139 (05141 10518) 


LEFT OMS 
CROSSFEED 


RIGHT OMS 
CROSSFEED 


АСЗ 


А 


[9] 


(526) 


OMS TANK ISOLATION and CROSSFEED 
Switches and Talkbacks 


When a crossfeed is set up, the tank isolation 
valves on the receiving side are closed. (The 
OMS propellant tanks on each side should not 
be directly connected in most cases.) The OMS 
crossfeed valves are then opened for the feeding 
and receiving side to establish a flow path from 
the OMS propellant tanks on one side to the 
engine on the other side. 


OMS propellant can also be fed to the aft RCS 
jets using OMS propellant from either OMS pod 
in orbit. This is called an OMS-to-RCS 
interconnect, and it provides the capability to 
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operate the aft RCS using OMS propellant for 
orbital maneuvers. The RCS has its own 
crossfeed valves, similar to the OMS crossfeed 
valves, that are used to connect the RCS 
propellant lines to the crossfeed lines. The same 
crossfeed lines are used for OMS crossfeeds, 
RCS crossfeeds, and OMS-to-RCS interconnects. 


When an OMS-to-RCS interconnect is set up, 
the RCS tank isolation valves are closed with 
AFT LEFT RCS and AFT RIGHT RCS TANK 
ISOLATION switches on panel O7. The RCS 
crossfeed valves are opened, and then one of 
the OMS crossfeed valves (B crossfeed valve) is 
opened. The OMS crossfeed valves on the non- 
feeding side are kept closed. This sequence 
prevents a direct connection between the OMS 
and RCS tanks. Normally, an interconnect 
involves one OMS pod feeding the RCS on both 
sides. This type of interconnect is used during 
orbit operations and is set up manually. The 
most important use of ап OMS-to-RCS 
interconnect would be during an ascent abort, 
when the interconnect setup is automatic. 


In each pod, parallel left or right OMS crossfeed 
valves are controlled by the LEFT and RIGHT 
OMS CROSSFEED A, B switches on panel O8. 
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The A switch controls the A fuel and A oxidizer 
ac-motor-operated valve actuators in the pod 
selected, and the B switch controls the B fuel 
and B oxidizer valve in the pod selected. When 
the A or B switch in a pod is positioned to GPC, 
the A or B pair of fuel and oxidizer valves is 
automatically opened or closed upon command 
from the orbiter computer. 


For example, when the A or B pair of crossfeed 
valves in the left pod is opened, fuel and 
oxidizer from the left pod are routed to the 
OMS crossfeed valves of the right pod; thus, a 
pair of A or B crossfeed valves in the right pod 
must be opened to permit the left pod fuel and 
oxidizer to be directed to the right OMS pod 
engine. 


A talkback indicator above the crossfeed 
switches on panel O8 indicates the status of the 
selected pair’s fuel and oxidizer valves. The 
talkback indicator indicates OP when both 
valves are open, barberpole when the valves are 
in transit or one valve is open and one closed, 
and CL when both valves are closed. The LEFT 
and RIGHT OMS CROSSFEED A and B 
switches on panel O8 permit manual control of 
the corresponding pair of fuel and oxidizer 
valves. 
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The LEFT and RIGHT OMS CROSSFEED A and 
B switches also provide the capability to supply 
OMS propellants to the left and right aft RCS 
engines. The left and right aft RCS will not be 
used to supply propellants to the OMS because 
the RCS tanks cannot support the flow rate 
required by the OMS engines. 


The OMS crossfeed fuel and oxidizer line 
pressures are monitored on telemetry and are 
transmitted to the RCS SPEC 23 display. 


In summary, to perform an OMS to RCS 
interconnect on orbit, the flight crew must first 
select FREE on the ORBITAL DAP controls on 
panel C3, then configure the following switches 
(using a feed from the left OMS as an example): 


1. Position the aft AFT LEFT RCS TANK 
ISOLATION 1/2, 3/4/5A and 3/4/5B 
and AFT RIGHT RCS TANK 
ISOLATION 1/2, 3/4/5A and 3/4/5B 
switches on panel O7 to CLOSE. 


2. Check that the talkback indicator 
above these switches indicates CL, 
and position the AFT LEFT RCS 
CROSSFEED 1/2, 3/45 and AFT 
RIGHT RCS CROSSFEED 1/2, 3/4/5 
switches to OPEN. The crew can then 
check for a propellant leak in the 
crossfeed lines. 


3. Check that the left OMS Не 
PRESS/VAPOR ISOL VALVE A and B 
switches on panel O8 are in the CL 
position. 


4. Check that the LEFT OMS TANK 
ISOLATION A and B valves (panel 
O8) are open, and verify that the 
talkback indicators show OP. 


5. Check the RIGHT OMS CROSSFEED 
А and B valves on panel O8 and verify 
that the indicators show CL. 


6. Open the LEFT OMS CROSSFEED B 
valve on panel O8 and verify the 
talkback indicator shows OP. Check 
the A valve is closed and verify the 
indicator shows CL. 


7. The left OMS-to-aft RCS interconnect 
quantity gauging can then be initiated 
by entering OMS PRESS ENA item 
entry (ITEM #5) on the RCS SPEC 23 
display. The crew can then select the 
desired DAP. 


There is software that | automatically 
repressurizes the left OMS propellant tanks. 1f 
the LEFT OMS He PRESS/VAPOR ISOL VALVE 
A switch is in GPC and the OMS PRESS ENA 
item entry (item по. 48) is done on RCS SPEC 23, 
the left OMS helium pressure vapor isolation 
valve А is commanded open when the left OMS 
tank (ullage) pressure drops to 236 psig, and the 
open commands are terminated 30 seconds later. 
If the left OMS tank (ullage) pressure remains 
below 236 psia, the sequence sest an OMS/RCS 
valve miscompare flag and sets a Class 3 alert 
and DPS fault message. This feature is not used 
nominally because it would feed any OMS or 
RCS leaks. 
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RCS Display (GNC SPEC 23) 


The flight crew can terminate the sequence and 
inhibit the OMS-to-RCS gauging sequence by 
use of the L/R OMS “OFF” item entry (item no. 
7) on the RCS display. The valves can then be 
reconfigured to their normal positions on panels 
07 and О8. The OMS-to-aft-RCS interconnect 
gauging sequence is not available in the backup 
flight control software, or in OPS 1 or 3. 


The OMS-to-aft-RCS propellant quantities are 
calculated by burn time integration. Once each 
cycle, the accumulated aft RCS jet cycles are 
used to compute the OMS propellant used since 
the initiation of gauging. The number of RCS 
jet cycles is provided by the RCS command 
subsystem operating program to account for 
minimum-impulse firing of the RCS jets. The 
gauging sequence is initiated by L/R OMS 
“AFT” item entry of the OMS left (item 5) or 
OMS right (item 6) interconnect on the RCS SPEC 
23 display and is terminated by the return to 
normal item entry (L/R OMS "OFF", item 7). 


The gauging sequence maintains a cumulative 
total of left and right OMS propellant used 
during OMS-to-aft-RCS interconnects and dis- 
plays the cumulative totals as a percentage of 
left and right OMS propellant on the RCS dis- 
play (ОМ5—КС5 QTY). The flight crew may 
manually update the OMS(RCS quantity by 
entering item 49 for the Left OMS or item 50 for 
the Right OMS interconnect quantity. 
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Valve Actuators 


There are 64 ac-motor-operated valve actuators 
in the OMS/RCS nitrogen tetroxide and 
monomethyl hydrazine propellant systems. An 
electrical microswitch in each of the ac-motor- 
operated valve actuators signals the respective 
valves’ position (open or closed) to the onboard 
flight crew displays and controls as well as 
telemetry. An extensive improvement program 
was implemented to reduce the probability of 
floating particulates іп Ње electrical 
microswitch portion of each ac-motor-operated 
valve actuator. Particulates could affect the 
operation of the microswitch in each valve and, 
thus, the position indication of the valves to the 
onboard displays and controls and telemetry. 


Thermal Control 


OMS thermal control is achieved by the use of 
strip heaters and insulation on the interior 
surface of the pods that enclose the OMS 
hardware components. Wraparound heaters 
and insulation condition the crossfeed lines. 
The heaters prevent propellant from freezing in 
the tank and lines The OMS heaters are 
divided into three segments: left pod, right 
pod, and crossfeed lines. 
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SM SPEC 89 PRPLT THERMAL Display 


Each OMS/RCS pod is divided into eight heater 
areas. Each of the heater areas in the pods 
contains an A and B element, and each element 
has a thermostat that controls the temperature 
from 55° to 75° F. These heater elements are 
controlled by the RCS/OMS HEATERS LEFT 
POD and RIGHT POD A AUTO and B AUTO 
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RCS/OMS HEATERS Switches on Panel А14 


switches on panel A14. Sensors located 
throughout the pods supply temperature 
information to the SPEC 89 PRPLT THERMAL 
display (items listed under POD) and telemetry. 


The crossfeed line thermal control in the aft 
fuselage is divided into 11 heater areas. Each 
area is heated in parallel by heater systems A 
and B, and each area has a control thermostat to 
maintain temperature at 55° F minimum to 75° 
F maximum. Each circuit also has an over- 
temperature thermostat to protect against a 
failed-on heater. These heater elements are 
controlled by the RCS/OMS HEATERS OMS 
CRSFD LINES A AUTO and B AUTO switches 
on panel А14. Temperature sensors near the 
control thermostats on the crossfeed lines 
supply temperature information on the SM 
SPEC 89 PRPLT THERMAL display (OMS 
CRSFD items) and telemetry. 


Thrust Vector Control (TVC) 


The OMS engines are attached to the orbiter in 
gimbal mounts that allow the engines to pivot 
up and down and from side to side. The OMS 
TVC system consists of a gimbal ring assembly, 
two gimbal actuator assemblies, and two gimbal 
actuator controllers. The engine gimbal ring 
assembly and gimbal actuator assemblies 
provide OMS TVC by gimbaling the engines in 
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pitch and yaw. Each engine has a pitch actuator 
and a yaw actuator. Each actuator is extended 
or retracted by one of a pair of dual-redundant 
electric motors and is actuated by general- 
purpose computer control signals. 


The gimbal ring assembly contains two mount- 
ing pads to attach the engine to the gimbal ring 
and two pads to attach the gimbal ring to the 
orbiter. The ring transmits engine thrust to the 
pod and orbiter. 


The pitch and yaw gimbal actuator assembly for 
each OMS engine provides the force to gimbal 
the engines. Each actuator contains a primary 
and secondary motor and drive gears. The pri- 
mary and secondary drive systems are isolated 
and are not operated concurrently. Each actua- 
tor consists of two redundant brushless ас 
motors and gear trains, a single jackscrew and 
nut-tube assembly, and redundant linear posi- 
tion feedback transducers. A GPC position 
command signal from the primary electronic 
controller energizes the primary dc motor, 
which is coupled with a reduction gear and a 
no-back device. 


The output from the primary power train drives 
the jackscrew of the drive assembly, causing the 
nut-tube to translate (with the secondary power 
train at idle), which causes angular engine 
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movement. If the primary power train is 
inoperative, a GPC position command from the 
secondary electronic controller energizes the 
secondary ас motor, providing linear travel by 
applying torque to the nut-tube through the 
spline that extends along the nut-tube for the 
stroke length of the unit. Rotation of the nut- 
tube about the stationary jackscrew causes the 
nut-tube to move along the screw. A no-back 
device in each drive system prevents 
backdriving of the standby system. 


The electrical interface, power, and electronic 
control elements for active and standby control 
channels are assembled in separate enclosures 
designated the active actuator controller and 
standby actuator controller. These are mounted 
on the OMS/RCS pod structure. The active and 
standby actuator controllers are electrically and 
mechanically interchangeable. 


The gimbal assembly provides control angles of 
(6° in pitch, and (7° in yaw with clearance 
provided for an additional 1 (for snubbing and 
tolerances. 


The thrust vector control command subsystem 
operating program (SOP) processes and outputs 
pitch and yaw OMS engine actuator commands 
and the actuator power selection discretes. The 
OMS TVC command SOP is active during the 
following operational sequences: orbit insertion 
(OMS-1 and OMS-2), orbit coast, deorbit, deor- 
bit coast, and return-to-launch-site abort (major 
modes 104, 105, 201, 301, 302, 303, and 601). 


The flight crew can select either the primary or 
secondary motors of the pitch and yaw actua- 
tors by item entry (PRI 28,29 and SEC 30,31 on 
the MNVR display), or they can turn the actua- 
tor motors off. The actuator command outputs 
are selected by the TVC command SOP, 
depending on the flag that is present; i.e., major 
modes, deorbit maneuver, orbit coast, RTLS 
abort, center-of-gravity trim, and gimbal check. 
The deorbit maneuver coast flag causes the TVC 
command SOP to output I-loaded values to 
command the engines to the entry stowed 
position. 


The presence of the RTLS abort and center-of- 
gravity trim flags causes the engines to be 
commanded to a predefined position with the 
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thrust vector through the center of gravity. The 
major mode RTLS flag by itself will cause the 
engines to be commanded to a stowed position 
for return-to-launch-site entry. 


The gimbal check flag causes the engines to be 
commanded to plus 7° yaw and 6° pitch, then to 
minus 7° yaw and 6° pitch, and back to zero? 
yaw and pitch. In the absence of these flags, the 
TVC command SOP will output the digital 
autopilot gimbal actuator commands to the 
engine actuators. The backup flight control 
system allows only manual TVC during a burn, 
but it is otherwise similar. 


The OMS TVC feedback SOP monitors the 
primary and secondary actuator selection 
discretes from the MNVR display and performs 
compensation on the selected pitch and yaw 
actuator feedback data. These data are output 
to the OMS actuator fault detection and 
identification and to the MNVR display. The 
OMS TVC feedback SOP is active during orbit 
insertion (OMS-1 and OMS-2), orbit coast, 
deorbit maneuver, and deorbit maneuver coast. 
The present OMS gimbal positions can be 
monitored on the MNVR display when this SOP 
is active, and the primary or secondary actuator 
motors are selected. 
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Fault Detection and Identification 


OMS Engine 


The OMS engine fault detection function detects 
and identifies off-nominal performance of the 
OMS engine, such as off-failures during OMS 
burns, on-failures after or before a burn, and 
high or low engine chamber pressures. 


Redundancy management software performs 
OMS engine fault detection and identification. 
It is assumed that the flight crew arms only the 
OMS engine to be used; the OMS engine not 
armed cannot be used for burns. Fault 
detection is initialized at solid rocket booster 
ignition and terminated after the OMS-1 burn 
or, in the case of an RTLS abort, at the transition 
from RTLS entry to the RTLS landing sequence 
program. Fault detection also is initiated 15 
seconds before each OMS burn and terminated 
after the OMS burn is complete. 


The PASS OMS engine fault detection uses both 
a velocity comparison and a chamber pressure 
comparison method to determine a failed-on or 
failed-off engine. The velocity comparison is 
used only after MECO since the OMS thrust is 
small compared to MPS thrust before MECO. 
The BFS OMS engine fault detection uses only a 
chamber pressure comparison method. 


The measured velocity increment is compared 
to a predetermined one-engine and two-engine 
acceleration threshold value by the redundancy 
management software to determine the number 
of engines actually firing. This information, 
along with the assumption that an armed 
engine is to be used, allows the software to 
determine if the engine has low thrust or has 
shut down prematurely. 


The chamber pressure comparison test 
compares a predetermined threshold chamber 
pressure level to the measured chamber 
pressure to determine a failed engine (on, off, or 
low thrust). 


The engine-on command and the chamber 
pressure are used before MECO to determine a 
failed engine. The velocity indication and the 
chamber pressure indication are used after 
MECO to determine a failed engine. If the 
engine fails the chamber pressure test but 
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passes the velocity test after MECO, the 
chamber pressure transducer will be considered 
failed. Such a failure would illuminate the red 
RIGHT OMS or LEFT OMS caution and 
warning light on panel F7, sound the master 
alarm, and produce a fault message, but the 
engine is still burning. If an engine fails the 
chamber pressure and velocity tests, the engine 
is considered failed, and a down arrow next to 
the failed engine appears оп the ММУК display, 
in addition to illumination of the light on F7 
and master alarm. 


When the flight crew disarms a failed engine by 
turning the appropriate ARM/PRESS switch on 
panel C3 to OFF, a signal is sent to the OMS 
burn sequence to shut down the engine and to 
signal guidance to reconfigure. ^ Guidance 
reconfigures and downmodes from two OMS 
engines, to one OMS engine, to four plus 
X RCS jets. 


OMS Gimbal Fault Detection 


The OMS gimbal actuator fault detection 
indicator detects and identifies off-nominal 
performance of the pitch and yaw gimbal 
actuators of the OMS engines. 


The OMS gimbal actuator fault detection is 
divided into two processes. The first 
determines if the actuators should move from 
their present position. Ш the actuators must 
move, the second part determines how much 
they should move and whether the desired 
movement has occurred. 


The first part checks the actuators’ gimbal 
deflection error (the difference between the 
commanded new position and the actuators' 
last known position) and determines whether 
the actuators should extend or retract or if they 
are being driven against a stop. If the actuators 
are in the desired position or being driven 
against a stop, the first part of the process will 
be repeated. If the first part determines that the 
actuator should move, the second part of the 
process is performed. 


The second part of the actuator fault detection 
process checks the present position of each 
actuator against its last known position to 
determine whether the actuators have moved 
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more than а threshold amount. Ш the actuators 
have not moved more than this amount, an 
actuator failure is incremented by one. Each 
time an actuator fails this test, the failure is 
again incremented by one. When the actuator 
failure counter reaches ап I-loaded value of 
four, the actuator is declared failed, and a fault 
message is output. The actuator failure counter 
is reset to zero any time the actuator passes the 
threshold test. 


The first and second parts of the process 
continue to perform in this manner. The 
process can detect full-off gimbal failures and 
full-on failures indirectly. The full-on failure 
determines that the gimbal has extended or 
retracted too far and commands reverse motion. 
If no motion occurs, the actuator will be 
declared failed. The flight crew’s response to a 
failed actuator is to select the secondary 
actuator electronics by item entry on the MNVR 
display. Gimbal failure on the left or right OMS 
will illuminate the red OMS TVC caution and 
warning light on panel F7. 


Operations 


The OMS burn sequence commands the OMS 
engines on or off and commands the engine 
purge function. The flight crew can select, via 
item entry on the MNVR display, a one or two- 
engine burn. 


The sequence determines which engines are 
selected and then provides the necessary 
computer commands to open the appropriate 
helium vapor isolation valves and the engine 
gaseous nitrogen solenoid control valves and 
sets an engine-on indicator. The sequence will 
monitor the OMS engine fail flags and, if one or 
both engines have failed, issue the appropriate 
OMS shutdown commands as soon as the crew 
has confirmed the failure by placing the OMS 
ENG switch on panel C3 in the OFF position. 
This will then terminate the appropriate 
engine’s control valve commands. 


In a normal OMS burn, when the OMS cutoff 
flag is true, the sequence terminates commands 
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to the helium pressurization/vapor isolation 
valves, and two gaseous nitrogen engine control 
valves. If the engine purge sequence is not 
inhibited, the sequence will check for the left 
and right engine ARM/PRESS signals, and 
open the engine gaseous nitrogen purge valves 
for two seconds for the engines that have the 
ARM/ PRESS signals present. 


The ascent profile for a mission uses a single 
OMS burn, and is referred to as direct insertion. 
In a direct-insertion ascent profile, the OMS-1 
burn after main engine cutoff is normally not 
required unless there is an underspeed. The 
OMS-2 burn is then used to achieve orbit 
circularization. Тһе direct-insertion ascent 
profile allows the main propulsion system to 
provide more energy for orbit insertion. 


Additional OMS burns using one or both OMS 
engines are performed on orbit according to the 
mission’s requirements to modify the orbit for 
rendezvous, payload deployment, or transfer to 
another orbit. 


Тһе two OMS engines are used to deorbit. 
larget data for the deorbit maneuver are 
computed by the ground and loaded in the 
onboard GPCs via uplink. These data are also 
voiced to the flight crew for verification of 
loaded values. After verification of the deorbit 
data, the flight crew initiates an OMS gimbal 
test on the DPS keyboard unit. 


Before the deorbit burn, the flight crew 
maneuvers the spacecraft to the desired deorbit 
burn attitude manually using the rotational 
hand controller, or automatically with an item 
entry on the MNVR display. Upon completion 
of the OMS burn, the RCS is used to null any 
residual velocities, if required. 


The aft RCS plus X jets can be used to complete 
any planned OMS burn in the event of an OMS 
engine failure. In this case, the OMS-to-RCS 
interconnect would feed OMS propellants to the 
aft RCS. 
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An L (R) OMS GMBL fault message will be 


OMS Caution and Warning Summary | 
displayed when there is а 2° difference 


e There are class 2 and class 3 alerts for the 


OMS. 


e Class 2 alerts can occur in all OPS and 


generate a MASTER ALARM light and tone 
and a light on the caution and warning 
matrix on panel F7. 


e A class 3 alert is generated by the primary 


GNC or SM software in OPS 2 and 8 or by 
the BFS software in other OPS. Class 3 alerts 
include an SM ALERT light and tone and a 
fault message. 


e The red LEFT OMS and RIGHT OMS lights 


on panel F7 will illuminate under the 
following conditions: 


between command and feedback position for 
an OMS gimbal actuator. 


An L (R) OMS PC fault message will be 
displayed when OMS engine Pc is less than 
80 percent. 


An L (R) OMS QTY fault message will be 
displayed when OMS propellant tank 
quantity is less than 5 percent. 


An L (R) OMS TK P fault message will be 
displayed when OMS oxidizer or fuel tank 
pressure is below 234 or above 288 psi; when 
OMS helium tank pressure is below 1,500 psi; 
OMS N2 tank pressure is below 1,200 psi; or 
OMS N2 regulator pressure is above 434 or 


. БЭ? below 299 psi. 
- Left or right OMS oxidizer tank 


pressure is less than 232 or greater than 
288 psi. 


An L (R) OMS VLV fault message will be 
displayed when OMS helium pressure valve 


and vapor isolation valve positions do not 
Left or right OMS fuel tank pressure is agree. 


less than 232 or greater than 288 psi. 

An L (R) OMS TEMP fault message will be 
displayed when OMS engine fuel injector 
temperature is above 260° Е. 


Left or right OMS engine Pc is less than 
80 percent when the engine should be 
on or greater than 80 percent when the 
engine should be off. 


е The red OMS ТУС light will illuminate when 
there is gimbal failure on the left or right 
OMS. 
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OMS Summary Data 


The OMS provides propulsion for orbit 
insertion, orbit circularization, orbit transfer, 
rendezvous, and deorbit. 


The OMS engines are collocated with the aft 
RCS in two independent OMS/RCS pods on 
each side of the orbiter’s aft fuselage. Each 
engine produces 6,087 pounds of thrust and 
specific impulse of 313 seconds. 


The ОМ5 engines use  monomethyl 
hydrazine as fuel and nitrogen tetroxide as 
oxidizer. The propellants are hypergolic. 


Gaseous pressurized nitrogen operates the 
OMS engine valves and is also used to purge 
the fuel lines at the end of each burn. 
Propellant flow to the engines is maintained 
by a helium pressurization system. 


Each OMS/RCS pod contains one OMS fuel 
tank and one OMS oxidizer tank. Crossfeed 
lines allow propellants to be used to operate 
either engine. OMS propellant can also be 
fed to aft RCS jets using OMS propellant 
from either or both pods. 


OMS engines are attached to the orbiter in 
gimbal mounts that allow the engines to 
pivot up and down and from side to side (+6° 
pitch, +7° yaw). 


Switches that the crew uses to operate the 
OMS are located on panels C3, O14, O16, C7, 
O8, and A14. Panels that display OMS 
parameters are F7 and O3. 


The MNVR display is used by the crew to 
enter burn targeting parameters. Other 
displays оп which OMS data appear are 
GNC SYS SUMM 2, SPEC 23 RCS, and SM 
SPEC 89 PRPLT THERMAL 
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OMS Rules of Thumb 


е 1 percent of OMS propellant 


= 6 fps 
=3n. mi. 


130 Ib (80 Ib oxidizer, 50 № fuel) uses 
400 psi of helium for long burns. 


One OMS engine causes approximately 1 fps? 
acceleration. 


For OMS ignition, there must be power and 
command to at least one coil on both control 
valves. 


OMS TVC requires an enable discrete from 
the FF MDM, and commands from the FA 
MDM. 


FUEL INJECTOR TEMP message may be a 
signature of a bad temperature transducer or 
a fuel blockage. 


CHAMBER PRESSURE message may be a 
signature of a bad pressure transducer or an 
oxidizer blockage. 


There are several failures that inop OMS FDI 
(FA MDM commfault or Pc transducer 
failing high during the burn). 


Always check redundant sources to confirm 
any malfunction. 


Max  blowdown оп the OMS 15 


approximately 39 percent. 


1,000 Ibs of OMS (approximately 8 percent) 
moves the X c.g. 1.5 inches aft and the Y c.g. 
0.5 inches left or right. 


Max OMS quantity for landing = 22 percent/ 
side. 
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219 ORBITER DOCKING SYSTEM Description 


The orbiter docking system (ODS) will be used 
to dock the shuttle to the International Space 
Station (ISS). The ODS has three major 
components: 


CONTENTS 


Description 

External Airlock 

Truss Assembly 

Androgynous Peripheral Docking 


e External airlock 
e Truss assembly 


е Androgynous Peripheral Docking 
System 


The ODS is located in the payload bay aft of the 
576 bulkhead, behind the tunnel adapter. 
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Orbiter Docking System View Looking Aft 
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ODS Configuration in the Payload Вау оп STS-117 


External Airlock 


The external airlock provides an airtight, internal 
tunnel between the two spacecraft after docking. 


Truss Assembly 


The truss assembly provides a sound structural 
base within which the components of the dock- 
ing system are housed. The truss assembly is 
physically attached to the payload bay and 
houses rendezvous and docking aids, such as 
camera/light assemblies and trajectory control 
systems. 


Androgynous Peripheral Docking System 


The Androgynous Peripheral Docking System 
(APDS), manufactured by RSC-Energia іп 
Kaliningrad, Russia, is designed to achieve the 
capture, dynamic attenuation, alignment, and 
hard docking of spacecraft by using essentially 
identical docking mechanisms attached to each 
vehicle. The primary components of each 
docking mechanism are a structural base ring 
housing 12 pairs of structural hooks (1 active, 1 
passive per pair), an extendable guide (active) 
ring with 3 petals, a motor-driven capture latch 
within each guide petal, 3 ball screw/nut 
mechanism pairs connected via a common 
linkage, 6 electromagnetic brakes (dampers), 
and 5 fixer mechanisms (that allow for only 
z-axis movement of the active ring). Two 
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control panels in the aft flight deck and nine 
avionics boxes in the subfloor of the external 
airlock provide power and logic control of the 
mechanical components. The docking 
mechanism on the rendezvousing spacecraft 
(orbiter) is intended to be active, while the 
corresponding mechanism оп {һе target 
spacecraft (ISS) is typically passive. 


DOCKING SYSTEM 
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APDS Avionics Overview 


Aft Flight Deck Panels 


The docking system power panel (A6L) is a 
Rockwell-built panel that provides power for 
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the various components of the ODS. This panel 
includes circuit breaker (cb) protection for all 
the ODS-related bus sources, as well as switches 
for application of logic and drive power to the 
APDS control panel, the APDS avionics boxes, 
the docking lights, and the vestibule depress 
valves. 


The APDS control panel (A7L) is supplied by 
RSC-Energia and is used to control the docking 
mechanism operation. On the left of the panel 
are nine circuit breakers (cb’s) that are operated 
as switches. The three control panel power cb’s 
supply logic bus power to the control panel 
functions. The heater/data collection units 
(DCU) cb’s provide power to heaters located 
around the docking ring. The H2/DCU and 
H3/DCU cb’s also provide redundant power to 
each of the two DCUs. The APDS power 
switches supply logic power to the power 
switching unit (PSU). Activating these cb's also 
illuminates indicator lights below each cb. 
Eighteen status lights are located in the middle of 
the panel and provide the prime feedback on the 
operation of the docking mechanism. The right 
side of the panel includes the functional controls 
of the mechanism that allow for manual 
operation of the various motor-driven 
components. Also on the right are the controls of 
the backup pyro separation system. 


SPEC 167 provides an alternate (backup) set of 
telemetry from the system. Information from 
the display is used to help monitor docking 
system operations. SPEC 167 details can be 
found in the Generic Reference Data Book. 


Power Switching Unit 


The PSU contains several relays with the sole 
purpose of distributing power, both logic and 
drive, to the other avionics boxes operating in 
the nominal docking sequence. These boxes 


include the docking system control unit 
(DSCU), docking mechanism control unit 
(DMCU), pressure actuation control units 


(PACUs), and latch actuation control unit 
(LACU). The DCUs are powered through the 
heater/DCU switches on panel A7L. The pyro 
firing control unit (PFCU) is powered through 
several other switches on both A6L and A7L 
panels. 


When the POWER ON pushbutton is depressed, 
it activates a momentary relay in the PSU and 
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begins a chain reaction of relay operations. The 
result is that several latching relays are set, 
providing the circuit flow paths for logic and 
drive power to be distributed to the other avionics 
boxes. 


Docking System Control Unit 


The DSCU contains extensive logic control 
circuits that interface with each of the remaining 
avionics boxes, except the PFCU. These circuits 
control the timing and sequencing of the 
automatic docking sequence. The DSCU also 
receives the inputs from any manual 
pushbutton command from the APDS control 
system panel and routes the inputs to the 
appropriate control box for execution. The 
DSCU is responsible for providing all feedback 
to the STATUS lights on the control panel as 
well. 


During docking, the initial contact and capture 
indications are routed into the DSCU. To receive 
a capture indication, at least one of two series of 
three "short" capture contacts (one contact from 
each of the three sensors) must be made, in 
addition to one of the six "long" capture contacts. 
When this condition is met, a latched logic loop is 
created, which in turn creates the capture ground 
buses. The latched loop can be broken only by a 
POWER OFF command, loss of at least two of 
three APDS bus powers, or loss of all six long 
capture contacts. 


The manual commands for RING OUT, 
UNDOCKING, OPEN HOOKS, and OPEN 
LATCHES require the creation of a dedicated 
ground bus. This is done using the APDS CIRC 
PROT OFF pushbutton. All other manual 
commands can be accomplished without 
removing the circuit protection. 


The DSCU also directly powers the fixers and 
the electromagnetic brakes (dampers). The 
fixers are energized whenever the ring is 
retracted during the auto sequence, and when- 
ever the ring is manually driven in either 
direction. (An unwanted fixers ON command 
can be avoided with the FIXERS OFF 
pushbutton command on the control panel.) 
The dampers are activated 5 seconds after the 
capture latching logic loop is created and are 
deactivated with a POWER ON command in the 
Docking Sequence Cue Card. 
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Docking Mechanism Control Unit 


The DMCU provides power to each of the two 
extend / retract actuator motors when 
commanded from the DSCU. The motors are 
single winding dc motors. The DMCU 
essentially has two similar halves, one to drive 
the ring in, and the other to drive the ring out. 
Instead of using latching logic, the DMCU uses 


mechanically latching relays to provide power 
to the motors. Therefore, the relays must be 
energized to the reset position to stop the ring 
drive. To accomplish this, the DSCU issues 
both ring drive and ring drive stop commands 
at the appropriate times. A ring drive stop 
command must be issued before a drive 
command in the opposite direction will be 
accepted because of inhibits built into the logic. 
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Pressure Actuation Control Units 


PACUs 1 and 2 control the operation of the 
active hooks, which are separated into two 
gangs of six each (hook gangs 1 and 2, 
respectively). Again, the DSCU issues the 
hooks open and close commands to the PACUs, 
based on the appropriate signals it receives. 
Each PACU uses latching logic to supply power 
to the two dc motors per actuator. The hook 
gangs are commanded simultaneously with one 
set of commands from the DSCU; ie, they 
cannot be operated separately. However, if the 
hooks are driving in one direction, the opposing 
command can be issued, and the motors will 
reverse direction. 


Latch Actuation Control Unit 


The capture latch motors, one motor per latch, 
are continuous drive motors controlled by the 
LACU. The capture latches are not redundantly 
powered (one motor per latch with latch 1 
powered via APDS POWER Ars, latch 2 via 
APDS POWER Bps, and latch 3 via APDS 
POWER Ср). The motors аге dc motors, but they 
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drive in one direction only, rotating an eccentric 
cam inside the capture latch. There are 10 sensor 
contacts per latch that provide feedback. There 
are two redundant open/close contacts for motor 
control, two redundant open/close contacts for 
panel feedback, and one open/close contact for 
SPEC 167 telemetry per latch. For the motor to 
operate; for example, in the close direction, one of 
the two open contacts must be mated, which 
provides a ground path for the motor current. 
When the closed position is reached, the closed 
contacts mate, but it is the loss of the open 
contact shortly thereafter that causes the motor to 
stop driving. With the closed contacts mated, it 
is now ready to drive in the open direction when 
the proper relays in the LACU are energized. АП 
the relays in the LACU serve to provide power 
and a ground path to each latch motor. 


Pyro Firing Control Unit 


The pyro power switches on panel A6L, and the 
PYRO Ар, Bp, Cp cb’s on panel A7L provide the 
main bus and logic power to the PFCU. With these 
switches powered, the PYRO CIRC PROT OFF 
pushbutton will remove one inhibit from the logic 
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by energizing several relays within the PFCU. This 
will allow the ACTIVE or PASSIVE HOOKS 
FIRING command from the control panel to be 
transmitted to each pyrobolt in the hook 
mechanisms. There is only one pyrobolt per hook, 
but there are two redundant initiators per charge. 


APDS Operational Sequences (OPS) 


Docking System Initialization 


Configuring the SYSTEM POWER SYS 1, 2 
switches on A6L panel provides three logic 
power buses to the Russian A7L panel. These 
switches also provide MN A/B power to the 
A6L panel for the docking lights, depress 
valves, etc. 


Docking Mechanism Powerup 


First, the PSU power switches on panel A6L are 
turned on to feed ММА and ММВ bus power to 
the PSU avionics box. Next, the three 
HEATER/DCU cb’s are turned on to activate 
heaters on elements of the docking mechanism. 
The H2 and H3 cb’s also power the two DCU 
avionics boxes that provide telemetry data for 
SPEC 167 and downlink. Now, on А71, the 
three control panel power cb switches are 
activated to provide logic power to the control 
panel pushbuttons and status lights. The three 
APDS power cb’s provide logic power from the 
control panel to the PSU avionics box. The 
POWER ON momentary pushbutton activates 
numerous relays within the PSU to distribute 
logic power to the following avionics boxes: the 
DSCU, the DMCU, the LACU, and both PACUs. 
This also enables the feedback circuitry from the 
various mechanism microswitches, which 
illuminate their respective status lights on the 
АЛ. panel. The control panel also has a lamp 
test pushbutton that is used to test all 18 pairs of 
status lights and the 2 pyro circuit protect off 
lights. 


Docking Ring Extension 


The docking system is launched with the active 
docking ring fully retracted and aligned in its 
final position, the structural hooks open, and 
the capture latches closed. In preparation for 
docking, the ring must be extended to its ready- 
to-dock or ring INITIAL position. To do this, it 
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is necessary to remove the inhibit that exists for 
manual operation of the mechanism. This is 
accomplished by depressing the APDS CIRC 
PROT OFF pushbutton. This pushbutton 
activates several relays that enable the logic for 
the manual RING OUT, OPEN HOOKS, OPEN 
LATCHES, and UNDOCKING pushbuttons. 
Without this step, these four pushbuttons are 
not operative. 


With the inhibit removed, the RING OUT 
command is sent to the DMCU avionics box. 
This command activates two dc motors to drive 
the ring out to its initial position (15.7 inches 
from final position) at a rate of approximately 
4.3 in/ min. As the ring is driving, the fixers are 
also activated to keep the ring aligned while it 
drives. One second after the ring reaches its 
initial position, the ring motors and the fixers 
are automatically commanded off. The system 
is then powered down. 


Docking 


Once the orbiter is on the Vbar (or Rbar) for 
final approach, the docking system is powered 
back on. When the POWER ON pushbutton is 
depressed, the docking system will be ready for 
docking. In this timeframe, it is also necessary 
to close the inner airlock hatch, check the 
function of the airlock fan, and turn on the 
docking lights and cameras. 


At contact, the initial contact light on A7L тау 
temporarily illuminate and the ring aligned 
light may go off. This will cue the crew to 
activate the preset postcontact thrusting (PCT) 
sequence, using the spare digital autopilot 
(DAP) pbi. The PCT is designed to provide the 
force required to attain capture with the APDS 
while not exceeding dynamic loads. To 
enhance the probability of success, the PCT 
should be initiated within 2 seconds of initial 
contact. To prevent exceeding loads, it should 
not be initiated once capture is achieved. 


The following steps are found in the Docking 
Sequence Cue Card. Once capture is achieved, 
the capture light illuminates. Тһе electro- 
magnetic brakes (dampers) are automatically 
energized 5 seconds post-capture to dampen 
relative motion between the two vehicles. When 
relative motion has ceased, the crew performs a 
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POWER ОМ pushbutton command to disable 
the dampers. When relative motion has again 
ceased, the docking sequence cue card calls for 
a set of actions to release any dampers that may 
still be mechanically engaged. This is 
accomplished by first executing a FIXERS OFF 
pushbutton, followed by a RING IN pushbutton 
to start the ring driving in. Five seconds later, 
the ring drive is terminated by a POWER ON 
pushbutton. The FIXERS OFF pushbutton is 
necessary to inhibit the FIXERS ON command 
that would automatically be issued with a ring 
drive command. Тһе fixers are disabled to 
prevent them from engaging the ring in a 
potentially misaligned configuration. Once the 
5-second RING IN is terminated and relative 
motion has ceased, an APDS CIRC PROT OFF 
pushbutton is executed to enable the RING 
OUT pushbutton. A RING OUT pushbutton is 
then initiated to start the ring out motion. The 
RING OUT is terminated 5 seconds later by a 
POWER OFF pushbutton followed immediately 
by a POWER ON pushbutton. This power cycle 
stops the ring drive and resets the APDS CIRC 
PROT and FIXERS OFF logic. Once the disable 
and release damper steps in the docking 
sequence cue card has been executed, an MCC 
GO is required to proceed with the next RING 
IN pushbutton. Conditions for MCC GO are 
ring alignment and no relative motion . 


Automatic Docking Sequence 


With the RING IN pushbutton and subsequent 
ring retraction, а FIXERS ON command is 
automatically initiated. The retracting ring will 
eventually pull the structural rings close 
enough together to activate the ready-to-hook 
sensors (three of four required to indicate RDY). 
The RDY signal activates the CLOSE HOOKS 
close command and the hooks begin driving 
closed. About 10 seconds after the hooks begin 
driving, they reach an in between sensor that 
stops the ring from retracting further. As the 
hooks drive closed, the mating surfaces will 
compress the pressure seals and activate three 
INTERFACE SEALED sensors (two of three 
required to indicate). Once the sets of hooks are 
closed, the docking sequence cue card calls for 
actions to load relieve the capture latches, open 
the capture latches, and retract the ring to the 
final position. An APDS CIRC PROT OFF 
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pushbutton, followed by a RING OUT 
pushbutton is executed to extend the ring 
slightly (10-second drive) to relieve loads on the 
capture latches. The capture latches are opened 
with an OPEN LATCHES pushbutton, and the 
ring is retracted to its FINAL position with a 
RING IN pushbutton. The docking is then 
complete, and the system is powered down. 


Failed Capture 


For failed capture cases that result in a bounce 
off, it is necessary to check out the mechanism 
before conducting another attempt. This can be 
simply accomplished by fully extending the 
ring to the FORWARD position (20.4 inches) to 
verify function and realign it, and either 
retracting it to the INITIAL position or fully 
retracting it to the FINAL position and then 
reextending it to the INITIAL position. If the 
mechanism appears functional, and the cause of 
the failed capture is apparent, it is not necessary 
to delay a second attempt (from the mechanism 
perspective only). For cases where the 
mechanism captures, but either the orbiter or 
the ISS does not get the signal (1.е., the orbiter 
does not get active damping or the ISS does not 
go to free drift), the response can be more 
complicated. If the crew can determine that the 
relative motion appears stable and will not 
bottom out the mechanism, the preferred 
approach is to hang on and wait it out. If 
motion ever appears unstable or excessive, the 
crew may be required to open the capture 
latches and back away. 


Manual Docking Sequence 


With the exception of the active damping, the 
entire docking sequence can be completed 
manually by the crew. Pushbuttons аге 
available to command the ring in or out, open 
or close the hooks, open or close the capture 
latches, and disengage the fixers. 


Undocking Timeline 


Prior to undocking, the external airlock and 
internal airlock hatches must be closed and the 
ISS verified ready for undock, including the 
release of any PMA hooks (located on the ISS 
docking ring) used for structural margin. 
Again, the docking lights and cameras will be 
turned on. The airlock vestibule will be 
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depressed using the switches on A6L, and leak 
checks will be performed. With that complete, 
the docking system will be powered up for 
undocking. 


The APDS circuit protect acts as an inhibit to 
using several other pushbuttons, as mentioned 
earlier. When the APDS CIRC PROT OFF push- 
button is depressed, the UNDOCKING, OPEN 
HOOKS, OPEN LATCHES, and RING OUT 
pushbuttons are enabled. The undocking 
sequence nominally requires just the APDS 
CIRC PROT OFF апа  UNDOCKING 
pushbuttons to be pushed. (In certain failure 
cases, the OPEN HOOKS and OPEN LATCHES 
pushbuttons could be required.) By depressing 
the UNDOCKING pushbutton, the hooks are 
commanded open. As they release, four spring 
plungers compressed between the mating 
surfaces, with a combined spring force of 
approximately 700 Їр, impart a small separating 
velocity on the ISS/orbiter. The sep burns are 
then performed, and the docking system is 
powered off. 


Contingency Undock 


This procedure assumes the orbiter hooks have 
failed closed during a previous undocking 
attempt. This would require use of the pyro 
system to separate. If the failed hooks are on 
the ISS side, the pyro system for the passive 
hooks can be used from the orbiter side to effect 
undocking. The pyro power switches on A6L 
energize four buses to the PFCU avionics box. 
The pyro cb’s on A7L enable three logic power 
buses to the PFCU. Depressing the PYRO CIRC 
PROT OFF pushbutton activates numerous 
relays within the PFCU and essentially enables 
the active and passive HOOKS FIRING 
pushbuttons. 


If the firing of the hook pyro bolts does not 
result in separation of the two vehicles, the only 
remaining option is for the crew to perform an 
extravehicular activity (EVA) to remove the 96 
bolts that attach the vestibule to the external 
airlock. The interface is held via specially 
designed quick-release clamps while the bolts 
are removed. 
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Operational Notes of Interest 


IFM Workarounds 


Because of the number of unknowns with the 
Russian avionics, an in-flight maintenance 
(IFM) procedure was deployed that would 
bypass the avionics and directly drive any 
motor on the APDS. The procedure has the 
crew access the American-made feedthrough 
connectors in the external airlock; the 
connectors are located in "bubbles" behind 
closeout panels. The connector required for the 
intended operation is demated and jumpers 
from the IFM pin kit are attached between the 
power and ground sockets in the connector and 
the IFM breakout box. When the breakout box 
is activated, the motors drive in the intended 
direction. With this procedure, however, 
feedback is lost due to the demated connector 
and must be accounted for before the procedure 
is accomplished. The IFM was originally 
intended as a backup to open the hooks should 
there be a power or avionics problem during 
undocking. However, the procedure was 
expanded to include the capability to drive any 
motor in any direction. 


Power On Time Constraints 


The avionics boxes have a power on time 
constraint of 2 hours, after which they must be 
off for 30 minutes before being repowered. This 
is due to heat buildup concerns of continuously 
energized relays within the boxes. 


Pushbutton Operation 


The manual pushbuttons on the APDS control 
panel should not be depressed for any more 
than 2-3 seconds. This is because pushing those 
pushbuttons activates momentary relays inside 
the DSCU, and the relays could overheat if they 
are energized for too long. 


In addition, each pushbutton on the A7L panel 
covers a set of electrical contacts. To ensure a 
positive electrical connection when depressing a 
pushbutton, the standard Russian training 
procedure is to instruct crews to use a “two 
fingers for two seconds” rule. This rule ensures 
that the pushbutton is fully and evenly 
depressed, making a good electrical connection. 
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Electrical Bus Failures 


The Russian design philosophy within the 
avionics utilizes three separate electrical paths; 
two of the three are required to activate any 
particular function. For feedback from sensors 
external to the avionics boxes, the three paths 
typically are combined into two paths to the 
sensors with the APDS A logic bus common to 
both paths; i.e., A and В complete through one 
sensor contact, A and C through the other. In 
this way, with any two buses powered, the 
system can complete its function. Conversely, 
however, if any one contact shorts to ground, 
two of the three paths associated with that 
function will be activated and possibly disrupt 
the system operation. This is the basis for all 
the avionics single-point failures. 


With this design, а workaround was 
implemented such that with any single sensor 
contact shorted to ground, the APDS A logic 
bus can be powered off to regain full manual 
functionality of the system. It does not, 
however, work very well when the DMCU is 
involved (ring position sensors), because the 
removal of one power leg must occur within a 
short time if commanding ring drive. Тһе 
relays in the DMCU аге not powered 
symmetrically like the other boxes, so the 2-of-3 
voting scheme is not entirely valid. Two 
commands are still required to activate the ring 
drive motors, but only one path (A or C) needs 
to be satisfied to stop the ring drive. There are 
workarounds for this scenario, but they are not 
as simple or straightforward. 
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Description 


The payload and general support computer 
(PGSC) is a laptop portable computer used 
either as a standalone computer or as a terminal 
device for communicating with other electronic 
systems. The PGSC is one element of the 
command and data services provided by the 
Space Shuttle Program (SSP). These computers 
are used in many different activities. 


Experiments 


PGSCs are used in the middeck or flight deck to 
interface with flight-specific experiments that 
may be located in the cabin or payload bay. The 
PGSCs are used to monitor experiment data 
and/or issue commands to payloads ог 
experiments in the payload bay. 


Orbiter Communications Adapter 


The orbiter communications adapter (OCA) is a 
card that is installed in the expansion tray to 
provide an interface to either the orbiter S-band 
PM system or the Ku-band system. While in the 
S-band mode, the OCA acts as a modem and 
allows electronic file transfers via one of the air- 
to-ground (A/G) audio loops, usually A/G 2 
through the payload specialist (PS) audio panel. 
The A/G 2 loop provides a bandwidth of 32 
kbps. The Ku-band system is capable of using a 
bandwidth of 128 kbps, in addition to one A/G 
loop for uplinks, thus enabling a higher data 
rate transfer. In the Ku mode, the downlink 
bandwidth could be in either 2 or 4 Mbps. 
Electronic file transfers include personal mail to 
individual crewmembers; Flight Data File (FDF) 
procedures; drawings; whiteboard, which is a 
real-time system of displaying what a person in 
MCC is sketching on a board; and video 
conferencing, which provides real-time video to 
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and from MCC and displays the video on the 
PGSC screen. 


Spacehab 


With Spacehab module missions, PGSCs in the 
Spacehab provide an interface to Spacehab 
systems data and to experiments in Spacehab. 


PDRS 


On missions with RMS operations, PGSCs are 
loaded with two RMS Situational Awareness 
applications. The RMS situational awareness 
display (RSAD) provides current joint angle 
information in relation to reach limits and 
singularities. It also has options to display 
other information such as position and attitude. 
Dynamic Onboard Ubiquitous Graphics 
(DOUG) provides an artificial simulated bird's 
eye view of the shuttle and Space Station from 
any perspective. 


Rendezvous 


During missions that will deploy/rendezvous 
with a payload or that will dock with Space 
Station, PGSCs are used as a tool to aid the 
crew's situational awareness about the orbiter's 
approach/ separation to/from the target. Other 
tools used in conjunction with the PGSCs 
include: 


® Handheld LIDAR (HHL) 


e Pulse code modulation master unit 


(PCMMU) decommutation software 
(PCDECOM). 

е Rendezvous proximity operations 
program (RPOP) 


e Trajectory control sensor (TCS) 


The above are used for the tools for rendezvous 
and docking (TRAD) system. 


Deorbit 


The Deorbit Manager application can be used to 
determine landing opportunities, deorbit 
targeting information, deorbit footprint 
information, as well as entry and landing c.g. 
data. This application is used in the event that a 
contingency deorbit is necessary with no 
communication with the ground. 
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Equipment flown to support PGSC activities 
includes: 
e IBM 760XD laptop 


e RS-422 and RS-232 У - cables to interface 
multiple PGSCs 


e PCMMU data cable to interface the 
orbiter PCMMU data to the PGSC 


e RS-422 PDIP cables to interface PGSC 
with equipment located in the payload 


е Cables to interface an HHL or TCS to a 
PGSC 


e Expansion tray to provide additional 
ports to the PCMMU payload bay 
equipment 


® OCA card to interface with orbiter 
communications systems 


e TV tuner to interface orbiter CCTV 
signals to а PGSC 
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Description 


The PDRS consists of the hardware, software, 
and interfaces required to remotely hold and 
control the movements of a specified object, 
usually a payload, and to remotely observe or 
monitor objects or activities. 


The PDRS includes the remote manipulator 
system (RMS), the manipulator positioning 
mechanisms (MPMs), the manipulator retention 
latches (MRLs), the manipulator controller 
interface unit (MCIU), and dedicated displays 
and controls. The PDRS also interfaces with 
other orbiter systems, such as the SM GPC, the 
electrical power distribution system (EPDS), 
and the CCTV. 
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Remote Manipulator System 


The RMS is the mechanical arm portion of the 
PDRS. The arm can perform several tasks, such 
as deploying апа retrieving a payload, 
providing a stable platform for EVA crew- 
member foot restraints or workstations, mating 
space station components, and taking payload 
bay surveys. The RMS is capable of man- 
euvering up to 586,000 pounds. 


The RMS is installed on the port longeron of the 
payload bay for those missions requiring it. 
Some deployable payloads do not require use of 
the RMS. 


NOTE 


Original concepts called for an optional 
second arm to be placed along the 
starboard longeron. It is no longer under 
consideration; however, there are still 
residual references to the starboard arm 
on orbiter panels and controls. 


The available starboard infrastructure is used 
for the orbiter boom sensor system (OBSS) that 
will be employed for all missions to inspect the 
orbiter thermal protection system. 


When cradled, the arm rests on three MPM 
pedestals that contain MRLs to secure the arm 
during launch, entry, and periods of inactivity. 
When the payload bay doors are closed, 
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RMS-Stowed Position and General Arrangement 
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including during launch and entry, the MPM is 
in the rolled in, or stowed, position. After the 
doors are opened on orbit, the MPM must be 
rolled out, or deployed, to not interfere with 
payload clearances. 


The arm has six joints connected via structural 
members (booms) and a payload capture/ 
release device (end effector) on the end. The 
arm is 50 feet 3 inches long and 15 inches in 
diameter. The arm has 6 degrees of freedom, 
three translational (X, Y, and Z) and three rota- 
tional (P, Y, and R). They are in reference not 
only to the orbiter but also to the end effector or 
the payloads it can carry. It weighs 905 pounds; 
the total system weighs 994 pounds. 
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RMS Displays and Controls, Aft Station 


On-orbit RMS operations are performed by a 
team of two arm operators, КІ and R2. КІ 
controls the actual RMS trajectories and is 
stationed on the port aft flight deck. R2 is 
stationed on the starboard aft flight deck and 
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controls DPS inputs, payload retention latch 
assemblies (PRLAs), and cameras. 


The RMS has a built-in test capability to detect 
and display critical failures. It monitors the 
arm-based electronics (ABE), displays and 
controls (D&C), and the manipulator controller 
interface unit (MCIU) firmware checks. 
Failures are displayed on a light matrix on 
panel A8U and on the DPS display and are 
available for  downlink through  orbiter 
telemetry. 


АШ the major systems of the ABE are monitored. 
Ihe MCIU checks the integrity of the 
communications link between itself and the 
ABE, D&C, and the orbiter SM GPC. The MCIU 
also monitors end effector functions, thermistor 
circuit operation, and its own internal integrity. 
The computer checks include an overall check 
of each joint’s status via the consistency check, 
encoder data validity, and the proximity of the 
arm to reach limits, soft stops, and singularities. 


The RMS can be operated only in a weightless 
environment because the arm motors are unable 
to move the arm’s weight under the influence of 
Earth's gravity. Each of the six joints has an 
extensive range of motion, allowing the arm to 
reach across the payload bay, over the crew 
compartment, or to areas on the undersurface of 
the orbiter. Arm joint travel limits are 
annunciated to the flight crew arm operator 
before the actual mechanical hard stop for a 
joint is reached. 


2.21-2 


2.21 Payload Deployment and Retrieval System (PDRS) 


Multilayer 
beta cloth Ч 


Arm їр 


шоог: 


то | 
Orbiter ig 
cable harness 


ermal protectio 


| MM/SCU 


USA007587 
Rev. A 


n kit ЕЗ camera bracket 


and light bracket 


Display and 3 
control panel Elbow cable Standard 
5 $РА camera harness «ЖҰЗ end effector 
bracket Ь сг 
ЗРА-| Upper cable Ebo A = 


ММ/5СО 


BDA - Backup drive amplifier 

EEEU - End effector electronics unit 

GPC - General-purpose computer 

MCIU - Manipulator controller interface unit 
MM/SCU - Motor module/signal conditioning unit 
RHC - Rotational hand controller 

SPA - Servo power amplifier 

THC - Translational hand controller 
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RMS Components 


Manipulator Controller Interface Unit 


The principal function of the MCIU is to handle 
and evaluate the exchange of information 
between itself and the SM СРС, the displays 
and controls, and the RMS. The MCIU 
manipulates data, analyzes and responds to 
failure conditions, and controls the end effector 
auto capture/release and 
rigidization/ derigidization sequence logic. 


A spare MCIU is usually flown on RMS flights 
and can be changed out with a failed MCIU in 
flight. Procedures for changing out the MCIU 
are contained in the АП Vehicle ТЕМ Checklist. 


Translational Hand Controller 


The THC allows an operator to control the 
three-dimensional linear motion of the RMS 
point of resolution (POR) by means of manual 
inputs. The POR is a software-defined point 
about which all translations and rotations occur. 
For an unloaded arm, the POR is at the tip of 
the EE. For a loaded arm, the POR is usually 
defined to be at or near the payload geometric 
center, but can also be defined at a berthing 
interface or the payloads center of gravity. The 
POR rate commands are proportional to the 
deflection of the controller. 
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Translational Hand Controller 


The hand controller provides three independent 
electrical inputs to the MCIU, one for each axis. 
The THC incorporates in each axis a spring and 
viscous damper, which provide suitable force 
feel characteristics to aid the operator. 


Rotational Hand Controller 


The RHC is a three-axis controller that provides 
electrical control signals for pitch, yaw, and roll 
control of the RMS. Control signals are propor- 
tional to manual input displacements in each of 
the three mutually perpendicular axes. Тһе 
RHC also provides additional RMS controls 
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through three switches located on the handgrip. 
The three switches are: 


e RATE HOLD pushbutton. This pushbutton 
is mounted on the top of the grip assembly 
and is thumb-operated. The pushbutton is 
used to maintain the POR translational and 
rotational rates at a commanded value. 
Rate hold is engaged when the pushbutton 
is depressed momentarily. Rate hold is 
disengaged when the pushbutton is again 
depressed momentarily. The rates can be 
biased once rate hold has been actuated and 
the hand controllers have been returned to 
detent by deflecting a hand controller a 
second time. 


e RATE switch. The VERNIER/COARSE 
RATE switch is a slide switch that produces 
the signal used by the RMS software to 
determine the POR rate limits when 
operating in resolved-rate modes and the 
joint rate limits when operating in SINGLE 
mode. The switch is configured to produce 
coarse (faster) rates when pushed away 
from the operator and vernier (slower) rates 
when pushed toward the operator. 


e CAPTURE/RELEASE switch. This rocker 
switch is mounted on the aft part of the grip 
assembly and is used to capture and release 
payloads. Тһе lower part of the switch 
sends the capture signal to the end effector, 
and the upper part sends the release signal. 
A finger-operated guard is provided over 
the release part of the switch to prevent 


Manipulator Arm Drive System 


Each joint of the manipulator arm is driven 
electromechanically, and the drive trains for all 
joints are similar, except for gear ratio. Each of 
the six joints has an identical reversible, brush- 
less DC motor that is used in both prime and 
backup modes of operation. Motor shaft 
position is provided by a commutation scanner 
assembly consisting of two optical commutators 
on the input side of each motor. One commuta- 
tor electronically interfaces with the primary 
motor drive amplifier and one electronically 
interfaces with the backup drive amplifier. 


The drive motor is held in a quiescent state by 
the brakes, which apply a brake pad to a contact 
surface on the motor shaft. Continuous applica- 
tion of 28 V DC to the brake is required to 
disengage the brake. 


Each joint contains a gear train that differs in 
gearing ratios. Dry lubrication is used through- 
out the gear trains. Backlash is minimized by 
the use of close tolerance gears and a backlash 
control device. 


An electro-optical encoder is fitted to the gear 
box output of each joint. The encoder is used to 
sense the angular position of the joint. The 
encoder uses an LED light source and a single 
disk. The encoder in the wrist roll joint has a 
hole in the center to allow cables to pass 
through. 


inadvertent actuation during normal 
operation of the RHC. 
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Rotational Hand Controller 


Each joint in the arm contains a digital servo 
power amplifier (SPA). Тһе SPA is associated 
with the motor module and position encoder for 
that joint. The major function of the SPA is to 
provide a drive signal to the motor. The SPA 
conditions incoming +28 V DC MN A power to 
the appropriate level needed to drive the joint, 
and regulates power to the other components of 
the motor module. The SPA also performs 
several built-in test equipment (BITE) checks to 
ensure it is functioning properly. Should one of 
these tests fail, a master alarm and SM message 
will be generated. 


One backup drive amplifier is located in the 
shoulder. The backup drive amplifier conditions 
+28 V dc MN B power for arm use and provides 
drive signals to the selected joint motor. 
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Motor Module 
Mechanical Arm Assembly 


The manipulator arm drive system components, 
the arm cable harness, and arm structural 
components form the mechanical arm assembly. 
The structural components consist of joint 
housings, electronic housings, and arm booms. 
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Each joint is fitted with a mechanical stop that is 
capable of stopping the joint from moving. This 
mechanical stop is known as the hard stop 


The shoulder brace is designed to minimize the 
high-pitch-axis moment loading on the shoulder 
pitch gear train during the launch environment. 
On orbit, the brace is released to allow RMS 
operations. The shoulder brace is designed to 
enable ground engagement of the release 
mechanism using an external power source. It 
cannot be relatched on orbit, but there is no 
requirement to relatch the brace before reentry 
and landing. A plunger is extended between 
two pieces of tapered metal, pushing the ends of 
the pieces outward, wedging the ends of the 
receptacle on the outer casing of the shoulder 
yaw joint, and engaging the shoulder brace. 
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Shoulder Brace 


Shoulder brace release is controlled by the lever- 
locked SHOULDER BRACE RELEASE switch on 
panel A8U. Positioning the switch to PORT 
releases the brace, which withdraws the plunger 
by an electrical linear actuator. This allows the 
tapered metal pieces to relax and move toward 
each other, which permits the brace to slide out 
of the shoulder yaw outer casing, unlatching the 
brace. The switch must be held 2 seconds after 
the RELEASE talkback indicator on panel A8U 
indicates gray because the microswitch 
indicating release is not at the end of the 
plunger's travel. A barberpole indication shows 
that the shoulder brace is not released. 


The arm boom assemblies are two thin-walled 
tubular sections called the upper and lower arm 
booms. The arm booms are structures designed 
to meet stiffness criteria. To achieve an efficient 
stiffness/weight design and to maintain 
simplicity of construction, a circular section 
graphite/epoxy composite design has been 
implemented. End flanges are made of 
aluminum alloy and are bonded and bolted to 
the graphite/epoxy tubular sections. Provisions 
are made for the installation of electrical cable 
harness assemblies along the length of each arm. 


2.21-6 


2.19 Payload Deployment and Retrieval System (PDRS) 


r JOINT 
3/ 52 4 


ELBOW WRIST 


ER 
2 TCH PITCH 
YAW. < YAW 
X 3 ROLL 
END EFF TEMP 
CRIT TEMP 


PANEL/ INST 


SHOULD! 
! 


EN. 
LED/ АВЕ/ 10 
х) 


SINGLE/DIRECT 


| SHOULDER BRACE RELEASE —] 
RELEASE 


m 
N [= 
STBD (аг) РОВТ 
© 2 772 
(516) 
» 4 (0513) 


( 36V73A8A1) 


SHOULDER BRACE RELEASE Switch and 
Talkback Indicator on Panel A8U 


On top of the lower arm and immediately 
below the elbow joint interface is a mount for 
installation of an elbow CCTV camera and 
pan/ tilt unit. 


Wire arm cable harnesses are designed to 
minimize electrical cross-talk and electromag- 
netic interference. They are of a weight-efficient 
design and are installed on the outside of the 
upper and lower arm booms, utilizing a light- 
weight mounting technique with adhesive 
Kapton tape. Sufficient slack is allowed for 
relative thermal expansion and contraction 
between the cables and arm booms and for 
movement of the joints. 


End Effectors 


The RMS can operate with standard or special- 
purpose end effectors. The standard end 
effector can grapple a payload, keep it rigidly 
attached as long as required, and then release it. 
Special-purpose end effector designs are avail- 
able and can be built and installed on the RMS 
during ground turnaround in place of the 
standard end effector. A male plug on the 
optional electrical flight grapple fixture can 
receive electrical power through а female 
connector located in the special purpose 
end effector. 
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Electrical Flight Grapple Fixture 


The standard end effector drive system captures 
or releases a payload using a rotating ring at the 
open end of the unit to close three wire snares 
around the payload-mounted grapple fixture. 
The entire snare ring is then pulled into the end 
effector until the grapple fixture base plate is flush 
against the tip of the end effector. This process is 
called rigidizing the end effector. To release a 
payload, the carriage is extended or derigidized to 
a point where there is no axial tension on the 
grapple fixture probe, and the snares are then 
opened. 


Standard End Effector 
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Thermal Protection 


The RMS has both passive and active thermal 
control systems. The passive system consists of 
multilayer insulation blankets and thermal 
coatings that reflect solar energy away from the 
arm and aid in controlling the temperature of 
the hardware. The blankets are attached to the 
arm structure and to each other with Velcro. 
Exposed areas around the moving parts are 
painted with a special white paint. 


To maintain the arm's temperature within 
predetermined operating limits, an active system 
of 26 heaters on the arm соизитез up to 525 watts 
of power at 28 V DC. There are two redundant 
heater systems, one powered from the orbiter's 
MN A DC bus and the other from the MN B DC 
bus. Only one system is required for proper 
thermal control. The heaters in each system are 
concentrated at the arm's joint and end effector to 
heat the electronics and ac motor modules. The 
heaters are enabled by the PORT RMS HEATER 
А and B guarded switches on panel A8L. When 
the switches are positioned to AUTO, the heaters 
are thermostatically controlled by 12 thermistors 
located along the arm. The joint thermistors turn the 
heaters on at 14? F and off at 43? F. The thermistor 
in the end effector turns the heaters on at 23? F 
and off at 52? F. 


LED numerical displays 1, 2, and 3 in the 
middle of panel A8U can be used in conjunction 
with the JOINT and PARAMETER rotary 
switches to display arm temperatures іп 
degrees Fahrenheit along with identification 
numbers. 
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For example, when the JOINT switch is 
positioned to END EFF TEMP and the PARA- 
METER switch is positioned to PORT TEMP, 
LED 1 displays the commutator's temperature, 
LED 2 displays the end effector electronics’ tem- 
perature, and LED 3 identifies the location as 
the end effector. 
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CCTV 


Тһе orbiter’s CCTV aids the flight crew in 
monitoring PDRS operations. Mounted on the 
end effector are a spotlight and a fixed CCTV 
camera that can be zoomed. A CCTV with pan 
and tilt capability is located below the elbow. In 
addition, four CCTV cameras in the payload bay 
can be panned, tilted, and zoomed. Keel 
cameras, which look up from the bottom of the 
payload bay, may be provided, depending on the 
mission tasks. LED illuminators normally are 
mounted around the lens of all of the CCTV 
cameras to add additional lighting when 
required. The two CCTV monitors at the aft 
flight deck station can each display any two of 
the CCTV camera views simultaneously with 
split screen capability. Two views show on the 
same monitor, which allows crewmembers to 
work with four different views at once. 
Crewmembers can also view payload operations 
through the aft flight station overhead and 
payload bay viewing windows. (See Section 2.3 
for CCTV operations.) 


Television camera 


Television camera 
and light bracket 


704.cvs 


Wrist CCTV and Light Configuration 
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Reach Limits, Soft Stops, and Hard Stops 


Each RMS joint has travel limits. As an example, 
the wrist pitch joint can be physically moved 
positive or negative 121.4° to the mechanical hard 
stop. At positive or negative 114.4°, software 
warns the RMS operator that the arm is 
approaching its end of travel by activating the 
yellow REACH LIM light and the red MASTER 
ALARM pushbutton indicator on panel A8U, 
sounding the master alarm, displaying a computer 
fault message, sounding an SM tone, and 
displaying a REACH LIMIT indication on the DPS 
display. 


Television 
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Elbow CCTV System 


If the operator continues driving the joint past 
the reach limit, the next warning is the soft stop. 
At this point (positive or negative 116.4? for the 
wrist pitch joint), the SOFTWARE STOP 
talkback on panel A8U (top center) will indicate 
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barberpole. The arm can only be operated in 
SINGLE, DIRECT, or BACKUP modes once it 
reaches a soft stop. If the operator continues to 
drive the joint in this direction, motion will stop at 
positive or negative 121.4°. All joint angles equal 
0° when the arm is cradled. 
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Joint Reach limit 
Shoulder yaw +175.4 
175.4 
Shoulder pitch +2.6° 
+140.4 
Elbow pitch -2.4° 
155.6 
Wrist pitch -114.4° 
+114.4 
Wrist yaw -114.6° 
+114.6 
Wrist roll -440.0° 
+440.0 
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Mechanical 
Soft Stop stop 
+177.4° +180° 
-177.4° -180° 
+0.6° -2° 
+142.4 +145° 
-0.4° +2.4° 
-157.6° -161° 
-116.4° -121.4° 
+116.4 +121.4° 
-116.6° -121.3° 
+116.6 +121.3° 
-442° -447° 
+442° +447° 
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Joint Travel Limits 


Safing and Braking 


Safing and braking are the two methods 
available for bringing the arm to rest. Safing 
can be accomplished by positioning the SAFING 
switch at the top of panel A8U to SAFE, which 
brings the arm to rest using the servocontrol 
loops. When the switch is positioned to AUTO, 
safing is initiated by the MCIU when certain 
critical built-in test equipment failures are 
detected or communication with the SM GPC is 
lost. The CANCEL position removes the safing 
state. The SAFING talkback indicator indicates 
gray when safing is not in progress and 
barberpole when safing is in progress. 


In the initial stages of PDRS operations 
development, safing was considered the pri- 
mary method whereby the MCIU could quickly 
respond to a failure condition and arrest the 
motion of the arm. MCIU initiations of auto 
brakes was added later to respond to certain 
failure conditions in the SPA. The BRAKES 
ON/OFF switch and talkback indicator are 
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located on panel A8U. The brakes are manually 
disengaged by moving the switch to the OFF 
position. This setting sends a hardwired signal 
to the brake logic function in the MCIU. The 
MCIU then commands the brakes to be lifted or 
removed from restraining the joints on the arm. 
The operator may reapply the brakes by placing 
the switch in the ON position. The arm operator 
is trained to respond to any suspected RMS 
failure condition by immediately placing the 
BRAKES switch to the ON position while oper- 
ating in any mode except DIRECT DRIVE and 
BACKUP. In DIRECT DRIVE the operator 
responds by moving the MODE rotary switch to a 
non-DIRECT DRIVE position. In BACKUP the 
proper response is to place the RMS SELECT 
switch to OFF. Use of the SAFING switch is not 
recommended. 
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Manipulator Positioning Mechanism 


The MPM is composed of a torque tube, the 
MPM pedestals, which are mounted on the 
torque tube, the MRLs, and the jettison system. 


MPM Pedestals 


The port MPM houses the separation system 
and provides the cradling units upon which the 
arm rests. There are four support assemblies. 
One is a shoulder attach point located at an 
orbiter 

X-value of 679.5. The support assembly at the 
port shoulder attach point is unique. Since the 
RMS is attached to the orbiter at this point, it 
does not contain an MRL, but does contain a 
separation system that is part of the MPM. 


The port MPM pedestals are located at X-values 
of 911.05, 1189, and 1256.5. The three pedestals 
are similar. Each contains two 45° saddle 
interfaces for cradling the arm and a retention 
latch to lock the arm in place. The mating 
hardware for the arm consists of two 45° mating 
plates to rest on the support saddle and a latch 
striker held by the retention latch. 


The support assembly also contains redundant 
sensors or microswitches to indicate ready-to- 
latch and latched /release conditions. 


The starboard pedestals for the OBSS are located 
at X values of 679.5, 911.05, and 1256.5. All 
three of these contain MRLs. The OBSS has 
additional bracing at the forward MPM attach 
point to help with loads in the X direction. A 
power connector is engaged in the forward 
MPM when the MRL is latched. This provides 
heater power to the OBSS while it is latched in 
the MPMs. 


MPM Torque Tube 


The MPM drive system consists of dual 
redundant motors rotating a torque tube that in 
turn drives the rotary actuators that move the 
RMS pedestals. The torque tube rotates the arm 
from its stowed position to its operational 
position outside the payload bay. The drive 
mechanism has two overcenter lock 
components, one of which locks in the deployed 
position and the other which locks in the 
stowed position. Тһе drive system contains 
microswitches needed for  stow/deploy 
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indications. Current flight rules prohibit loaded 
arm operations from the stowed configuration. 


The PORT RMS DEPLOY/STOW switch is on 
panel A8L. The talkback above the switch 
indicates STO when the MPMs are in the 
stowed position, DPY when they are deployed, 
and barberpole in transit. The status of the 
shoulder MPM can be monitored on the SPEC 
94 PDRS CONTROL display (MPM 
STO/DPLY). 


The STBD RMS DEPLOY/STOW switch is also 
located on panel А81. The talkback and 
microswitch operate the same as the Port MPM. 
An item entry on SPEC 94 PDRS CONTROL is 
used to select Port or Starboard MPM data for 
display. 
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PDRS CONTROL Display (SPEC 94) 
Manipulator Retention Latches 


The arm is latched in three locations (aft, mid, 
and forward) along the port longeron to secure 
it for launch and entry loads. The retention 
latches are dual rotating surfaces that are driven 
by redundant motors. When the three ready-to- 
latch indications are received, the operator 
positions Ше PORT КМ5 RETENTION 
LATCHES switch on panel A8L to LATCH, and 
the retention hooks catch the striker bars on the 
RMS and secure them firmly in place. АП three 
latches are controlled by the switch. The MRL 
system contains microswitches for ready to 
latch, latched, and released indications. Тһе 
microswitch status can be viewed via panel A8L 
(AFT, MID, FWD) talkbacks and the SPEC 94 
PDRS CONTROL display (LAT/REL/RDY). 
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The OBSS is latched in three locations along the 
starboard longeron. The retention latches 
operate the same as described for the port side. 
The only difference is that the STARBOARD 
RMS RETENTION LATCHES switch was 
changed to a lever lock switch to prevent 
inadvertent release of the OBSS. 


Jettison System 


If for any reason the arm or OBSS cannot be 
recradled and restowed, they can be jettisoned 
so that the payload bay doors can be closed. 
There are four separation points, on the port side, 
one at the shoulder and one at each of the three 
pedestals. The starboard side has separation points 
at each of the three pedestals. Each of the 
separation points is individually actuated. The 
separation system is designed to cause a non- 
impulsive separation. 


The shoulder attach point has a wire bundle 
that must be separated prior to shoulder 
support separation. The wire bundle is severed 
by a redundant pyro-operated guillotine prior 
to the activation of the support jettison system. 


The jettison system works by redundant pres- 
sure cartridges firing to force down a retractor 
that pulls back four overcenter tie-down hooks, 
releasing the arm or OBSS at the selected 
support. 


The GUILLOTINE switches for the RMS are 
located on panel A14. 
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Payload Retention Mechanisms 


Non-deployable payloads are retained by 
bolted passive retention devices, апа 
deployable payloads are secured by motor- 
driven, active retention devices. Payloads are 
secured in the orbiter payload bay with the 
payload retention system or are equipped with 
their own unique retention systems. The orbiter 
payload retention system provides three-axis 
support for up to three payloads per flight. The 
payload retention mechanisms secure the 
payloads during all mission phases and allow 
installation and removal of the payloads when 
the orbiter is either horizontal or vertical. 


Attachment points in the payload bay are in 
3.933-inch increments along the left- and right- 
side longerons and along the bottom centerline 
of the bay. Of the potential 172 attach points on 
the longerons, 48 are unavailable because of the 
proximity of spacecraft hardware. The remain- 
ing 124 may be used for deployable payloads. 
Along the centerline keel, 89 attach points are 
available, 75 of which may be used for 
deployable payloads. 


Bridge Fittings 


Bridge fittings are used to react to the loads 
imparted to the orbiter structure by the 
payload, and provide a structural interface for 
both the payload retention latch assemblies 
(PRLAs) and active keel actuators (AKAs). 
Bridge fittings fall into standard and 
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lightweight categories, just as the PRLAs and 
AKAs do, and, of course, differ in type when 
used to interface longeron versus keel latches. 


The keel bridge has a T-slot that accepts the 
T-bar fitting of the AKA; the two mated 
members are bolted in place. Contrastingly, the 
longeron bridge fitting incorporates a T-bar rail 
onto which the PRLA T-slot slides. 


The standard and lightweight bridge fittings 
differ in both cross-sectional thickness and 
material. The standard fittings are made of tita- 
nium and are thicker than their lightweight alu- 
minum counterparts. Bridge fittings, whether 
standard or lightweight, longeron or keel type, 
are compatible with the hole patterns and 
wiring routes for а particular bay only. 
Therefore, each fitting is unique dimensionally 
for any given bay. 


There are 13 longeron bridges per side and 12 
keel bridges available per flight. Only the 
bridges required for a particular flight are 
flown. The bridges are not interchangeable 
because of main frame spacing, varying load 
capability, and subframe attachments. 


The longeron bridge fittings attach to the pay- 
load bay frame at the longeron level and at the 
side of the bay. Keel bridge fittings attach to 
the payload bay frame at the bottom of the 
payload bay. 
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Latches 


There are normally three or four longeron latches 
per payload. Two primary latches are required to 
take the X- and Z-loads, and one or two 
stabilizing latches are required to take Z-loads. 
Ihe stabilizing latches float free in the X-X 
direction. Тһе latches are driven by dual- 
redundant motors. 


A payload may also require a keel latch that takes 
the side loads. The keel latch centers the payload 
in the Y direction in the payload bay when it 
doses; the keel latch must be closed prior to 
closing the longeron latches. The keel latch can 
float plus or minus 2.75 inches in the X direction. 
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Trunnions 


The payload trunnions are the cylindrical 
portion of the payload that interfaces with the 
payload retention system. The trunnions that 
interface with the longeron are 3.24 inches in 
diameter and 7 or 8.75 inches long, depending 
on their position in the payload bay. The keel 
trunnions are 3 inches in diameter and vary in 
length from 4 to 11.5 inches, depending on 
where they fit in the payload bay. 


Payload Guides/Scuff Plates 


Payload guides and scuff plates assist in 
deploying апа berthing payloads in the 
payload bay. The payload is constrained in the 
X direction by guides and in the Y direction by 
scuff plates and guides. Bright yellow and 
black striped markings are painted on the 
guides to enhance visual cues during payload 
berthing. The guides are mounted to the 
inboard side of the payload latches and 
interface with the payload trunnions and scuff 
plates. The scuff plates are attached to the 
payload trunnions and interface with the 
payload guides. 


The guides are V-shaped, and one part of the V is 
2 inches taller than the other. Parts are available 
to make either the forward or aft guide taller. 


This difference enables the operator monitoring 
the berthing or deployment operations through 
the aft bulkhead CCTV cameras to better deter- 
mine when the payload trunnion has entered 
the guide. The top of the taller portion of the 
guide is 24 inches above the centerline of the 
payload trunnion when it is all the way down 
in the guide. The top of the guide has a 9-inch 
opening. These guides are mounted to the 
8-inch guides that are a part of the longeron 
payload retention latches. 


Payload Retention System Controls 


The PAYLOAD RETENTION LOGIC POWER 
SYS 1 switch on panel A6U positioned to ON 
provides MN A bus power to the PAYLOAD 
SELECT rotary switch. The SYS 2 switch 
positioned to ON provides MN B bus power to 
the PAYLOAD SELECT switch. 
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Positioning the PAYLOAD SELECT switch to 1 
provides power-on logic for the dual actuator 
motors of up to five latches for one payload, the 
latch status for that payload on DISP 97 PL 
RETENTION, and the talkback indications 
associated with the payload. Position 2 of the 
switch provides power-on logic for the dual 
actuator motors of up to five latches for the 
second payload, the latch status for that 
payload on DISP 97, and the talkback 
indications | associated with that payload. 
Position 3 provides power-on logic for the dual 
actuator motors of up to five latches for the 
third payload, the latch status for that payload 
on DISP 97, and the talkback indications 
associated with up to five latches. In addition, 
two monitor settings are available. These 
positions allow the crewmember to monitor all 
payload retention latches at once on DISP 97, 
but inhibit all latch control commands. 
Talkback indicators are also inhibited when in 
the monitor position and indicate barberpole. 


The PAYLOAD RETENTION LATCHES 1, 2, 3, 
4, and 5 switches on panel A6U are enabled by 
the PAYLOAD SELECT rotary switch. Position- 
ing the PAYLOAD SELECT switch to 1 enables 
up to five retention latches for payload 1, and 
each of the five retention latches for payload 1 
would be controlled by the individual 1, 2, 3, 4, 
and 5 switches. Positioning the PAYLOAD 
SELECT switch to 2 or 3 has the same effect for 
payloads 2 and 3. 


NOTE 


Payload retention latch wiring configura- 
tions are mission-dependent. 


Positioning a PAYLOAD RETENTION 
LATCHES switch to RELEASE enables 
AC power to the dual electric motors associated 
with the retention latches designated by the 
position of the PAYLOAD SELECT switch, 
driving the retention latch open. The operating 
time of the latch with both motors operating is 
30 seconds; with only one motor operating it is 
60 seconds. The talkback indicator immediately 
above the switch indicates REL when the latch 
is fully open. There are two microswitches for 
the REL talkback indication; however, only one 
is used to control the talkback indicator 
(the “A” indication). The talkback is barberpole 
when the payload latch is between latch and 
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release. There are two microswitches for the 
ready-for-latch talkback indication; however, as 
above, only the “A” indication controls the 
talkback indicator. 


NOTE 


When driving the PAYLOAD RETEN- 
TION LATCHES to RELEASE, do not 
continue to command a release for longer 
than 60 seconds if no REL indication is 
received. If the “A” release microswitch 
has failed whereby по indication is 
present, the latch will continue to drive 
against the fully open position as long as 
RELEASE is selected, which could quickly 
lead to actuator damage. 
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PAYLOAD RETENTION Switches and Talkbacks on Panel A6U 


Positioning a PAYLOAD RETENTION 
LATCHES switch to LATCH provides AC power 
to the dual electric motor associated with the 
latches designated by the position of the 
PAYLOAD SELECT switch, driving the 
retention latch closed. The operating time of 
one or both motors is the same as for releasing a 
payload. A gray READY talkback indicates that 
latch is ready to latch. The indicator shows LAT 
when the latch is closed. There are two 
microswitches for the LAT indication; however, 
only system A is required to control the 
talkback indicator. 


Operations 


The RMS can perform a wide range of opera- 
tions. This section gives an overview of these 
operations, as well as the actions required to 
configure the arm to support these operations. 


On-Orbit Initialization 


Prior to any planned RMS operations, the 
shoulder brace must be released, and for any 
loaded operations, the MPM must be deployed. 
This procedure contains both of these activities, 
as well as the deployment of the starboard MPM. 
The status of some of the panel lights, talkbacks, 
and switches is also checked. The PDRS 
CONTROL SPEC 94 display is called up, and 
the interface with the SM GPC is established. 
This operation is usually scheduled at about 2.5 
hours MET. 
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RMS Powerup 


This procedure releases the MRLs and gets the 
arm out of the cradle to a “pre-cradle” configu- 
ration. This procedure may be performed 
several times during a flight, as the arm is 
usually powered down when not in use. The 
RMS POWER switch is on panel АВГ. 


NOTE 


Placing the RMS POWER switch to 
PRIMARY generates an RMS master 
alarm. This alarm is generated because 
the panel powers up faster than the 
MCIU, thereby causing the MASTER 
ALARM light and tone to annunciate 
before the MCIU can respond with the 
proper master alarm flag. This is a 
normal condition and will occur every 
time the RMS POWER switch is cycled 
OFF and back to PRIMARY. 


RMS Checkout 


This procedure verifies in exacting detail that all 
the arm hardware and the panel switches and 
functions are in good operating condition. This is 
about an hour-long procedure and is done only 
once per flight. It is usually scheduled as early as 
possible in order to allow plenty of time for any 
problems to be worked around. 
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Flight-Specific Operations 


The arm can perform nine different types of 
operations. One or more may be done per 
flight. These operations are broken down as 
described below. 


Contingency-Only Unloaded Operations 


These unscheduled operations will only be 
performed if a problem arises in another orbiter 
system. The training for these operations is 
very minimal, and the tasks performed would 
involve surveys of some parts of the orbiter. 


Unloaded Operations 


These scheduled operations involve 
maneuvering the arm to various positions or 
along various trajectories. An example of this 
would be a payload survey. There is no 
payload attached to the arm during these 
maneuvers. 


Loaded Operations 


These operations involve grappling a payload 
that is berthed in the payload bay, releasing the 
payload latches, unberthing the payload, 
maneuvering the payload, reberthing and 
relatching the payload, and ungrappling the 
payload. 
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Deploy Operations 


These operations involve grappling a payload 
that is berthed in the payload bay, releasing the 
payload latches, unberthing the payload, 
maneuvering the payload to the release position 
and orientation, and releasing the payload. 


Retrieve Operations 


These operations involve capturing a free-flying 
payload, maneuvering the payload to a hover 
position (aligned with the berthed position, but 
about 10 feet over the bay), berthing and 
latching the payload, and ungrappling it. 


Deploy and Retrieve Operations 


These operations apply to one payload that is 
both deployed and retrieved, as in the steps 
listed above. The order of deploy and retrieve 
operations is flight specific. 


Station Build Operations 


These operations apply to taking a station 
element such as an MPLM and then either 
installing it on to the ISS or handing it off to the 
SSRMS for subsequent installation. These tasks 
could also involve removing a station element 
and relocating it to another port. 
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RMS/EVA Operations 


These operations involve using the RMS as a 
portable work platform with an EVA 
crewmember attached to the end of the arm 
with a foot restraint. The EVA crewmember can 
be moved around via the RMS because it 
provides access to worksites where the tasks 
would be made more difficult if they had to be 
performed free floating. 


OBSS Operations 


While undocked, these operations involve 
grappling the OBSS, unberthing the OBSS, and 
using auto sequences to inspect the orbiter 
thermal protection system (TPS). When docked 
to ISS, the operations also include a handoff of 
the OBSS from the SSRMS. 


RMS Powerdown 


This procedure returns the arm to the cradled 
configuration and relatches the MRLs. This is 
usually done any time arm operations are not 
required. However, there are occasions when the 
arm will be left uncradled to meet mission- 
specific objectives (e.g., when the RMS cameras 
are used to view an ISS mechanism overnight). 
The power to the ABE is deactivated, but the 
MCIU remains powered up and in contact with 
the SM GPC. For the final flight powerdown, the 
MPM will be stowed as part of this procedure. 


RMS Deactivation 


This procedure removes power from the RMS 
heaters and turns off the MCIU. This will only 
be done after all arm operations scheduled for 
the flight have been completed. 


RMS Jettison 


This is a contingency procedure that is used to 
jettison the arm only, the arm plus MPM 
pedestals, or the arm/payload combination. 
Jettison causes a non-impulsive separation of 
the arm, and then the orbiter pilot performs an 
orbiter separation from the jettisoned unit. 
Should the jettison have to be done in an 
expedited manner, a QUICK RESPONSE JETTI- 
SON procedure has been created and is located 
in the contingency deorbit checklist. 
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OBSS Jettison 


This is a contingency procedure that is used to 
jettison the OBSS plus the starboard MPM 
pedestals. The berthed OBSS is grappled prior to 
pedestal jettisoning, then the OBSS with attached 
pedestals is maneuvered to a jettison position and 
released. Тһе orbiter pilot performs an orbiter 
separation from the jettisoned unit. 


Operating Modes 


The RMS can be operated in a variety of modes. 
These modes are detailed below. 


Single Joint Modes 


Operating the arm in a single joint mode allows 
only one joint at a time to be driven. Single joint 
operations are very painstaking and time con- 
suming, and so are only used when absolutely 
necessary. Uncradling and cradling must be 
done via a single joint mode, since the arm is in 
the soft stop region for two joints. The single 
joint modes are SINGLE, which is a computer- 
supported mode; DIRECT, which commands 
the joints via hardwired signals and uses MN A 
(primary) power; and BACKUP, which com- 
mands the joints via hardwired signals and uses 
MN B (backup) power. 


Manual Augmented Modes 


The manual augmented modes are computer- 
supported modes that use the RMS hand 
controllers (HCs) to control the arm trajectories. 
The modes that fall into these categories are 
orbiter unloaded, orbiter loaded, end effector, 
and payload modes. They are selected by 
corresponding positions of the MODE rotary 
switch on panel A8U: ORB UNL, ORB LD, END 
EFF, PL. 


2. SYSTEMS 


2.21 Payload Deployment and Retrieval System (PDRS) 


USA007587 
Rev. A 


AUTO 1 m 


ORB UNL, м 


AUTO 2.) 


END EFF, y) 


AUTO 3 | 


ORB LD, y) 


AUTO 4) 


PAYLOAD, |) 


ОРЕ CMD, p] 


SINGLE | y) 


TEST (yj 


DIRECT , y) 


©, 


(X051) 


ORB UNL 
4 


RRD таст 


QE 


MODE 


MANUAL 
емо 
Е 


DIRECT 


GPC DATA 


READY, 


(м) 


SINGULAR 


ІМ PROG 


(м) 


CONTR ER 


(Х053) 


AUTO SEQ 
РЕОСЕВОУ 


5780 TEM 


о 


+58. 


(N21 


X/ PITCH 


PITCH 


(A2) 


BACKUP CONTROL 
ЫГ 9) 


SHOULDER ELBOW "ыы 


д РЇТСН 
YAW 
ROLE 


JOINT 
ATTITUDE Р 


POSITION ХИ 


30 58С 


r АММММ 


PAYLOAD ВЕІ 8А5Н DIRECT DRIVE 


N 252 
Ч К ) | 
М) 


BRIGHT 


Ө 
—_—__ 


Mode Selection Rotary Switches and Lights on 
Panel A8U 


In standard RMS operations, the manual 
augmented modes are supplemented with the 
position/orientation hold select (POHS) mode. 
POHS mode is a software improvement that has 
greatly increased the ability of the RMS 
operator to control the arm trajectory. The 
POHS mode is used to improve RMS 
performance in the manual augmented modes 
by correcting unwanted motion of the point of 
resolution. POHS mode can be selected on 
SPEC 94. When POHS is enabled (SPEC 94, 
ITEM 28), POR position hold is used to prevent 


POHS is disabled (SPEC 94, ITEM 29), joint 
position hold is used. The POHS reference 
position and attitude are displayed on SPEC 
169. The resultant POHS errors for translation 
and rotation are also displayed on SPEC 169. 


ORB UNL. Orbiter unloaded mode uses the 
unloaded POR and defines the HC inputs to 
coincide with the desired arm trajectory as 
viewed out the aft windows. For example, to 
translate the arm to the left as you are looking 
out the aft window (toward the starboard side 
of the vehicle), the THC would be deflected to 
the left. To move the arm out of the payload 
bay (up), the THC would be deflected up. To 
bring the arm toward you, the THC would be 
pulled out. RHC inputs are similar. To pitch 
the arm or payload up with respect to you as 
you are looking out the aft window, the RHC 
would be tilted back toward you. To yaw the 
arm/ payload as you are viewing it, the RHC 
would be twisted left or right about its long 
axis. To roll with respect to your view, the RHC 
would be deflected left and right. 


ORB LD. Orbiter loaded mode is usually used 
for a loaded arm. The HC inputs in orbiter 
loaded mode are identical to those іп ORB UNL; 
however, the POR is defined to be at a point 
within the grappled payload. 


In the orbiter loaded mode, there are three types 
of HC references: normal, fly-to (also referred 
to as fly-camera), and fly-from (also referred to 
as fly-payload). These command references are 
mutually exclusive and can be enabled or 
disabled via SPEC 94. Fly-payload is used the 
same way orbiter loaded mode is used; how- 
ever, any orbiter-based camera or window view 
can be used. Fly-camera is the same as fly- 
payload with all commands reversed. 


END EFF. End effector mode allows the HC 
inputs to reflect motion desired when viewed 
through the end effector camera. The sense the 
operator has is that he or she is “sitting” on the 
end of the end effector. When the arm is 
aligned parallel to the longeron, and the wrist 
joint angles are all zero, HC inputs in END EFF 
coincide with those in ORB UNL/LD. If the 
wrist is then pitched down іп that 
configuration, the motion to take the arm down 


POHS reference drift. When into the payload bay would be a THC 
downward deflection in ORB UNL/LD, but 
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would be a push inward on the THC in END 
EFF mode. 


PL. Payload mode uses the software-predefined 
POR and coordinate system and applies the HC 
inputs as follows: THC-in will cause motion in 
the +X axis of the software-defined PL 
coordinate system; THC-out corresponds to 
motion along the -X axis of the PL coordinate 
system. THC-right will cause motion along the 
PL +Y axis, while THC-left will cause motion 
along the PL -Y axis. THC-down will cause 
motion along the PL +Z axis, and THC-up will 
cause motion in the PL -Z axis. RHC P will 
cause motion about the PL Y axis, RHC Y will 
cause rotation about the PL Z axis, and RHC R 
will cause rotation about the PL X axis. 


TEST. Test mode, while not strictly speaking a 
manual-augmented mode, uses the same POR 
and coordinate system definition as ORB UNL. 
Test mode allows the arm operator to monitor 
and verify the HC commands without causing 
any arm motion. This is done by cutting off the 
joint drive current at each joint. 


AUTO Modes 


There are two types of auto modes, auto-com- 
manded auto sequences апа operator-com- 
manded auto sequences. In either case, the SM 
GPC controls the arm trajectory. 


OBSS operations require many long Auto 
trajectories. POHS was added to Auto modes to 
better detect sluggish joints that may cause the 
arm to deviate from the planned trajectory. 
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Auto-Commanded Auto Sequences. These 
sequences consist of up to 200 pre-defined 
points that can be grouped in up to 20 sets, or 
sequences. To use an auto-commanded auto 
sequence, the operator enters the desired se- 
quence number on the PDRS CONTROL SPEC 
for one of AUTO 1, 2, 3, or 4 slots, then selects 
AUTO 1, 2, 3, or 4 via the MODE rotary switch 
on panel A8U. The arm is then commanded to 
start via the AUTO SEQ switch, and will fly 
through that predefined trajectory. 


Operator-Commanded Auto Sequences. For 
these, the arm operator must manually enter a 


desired POR end position and attitude via the 
PDRS CONTROL SPEC. Тһе operator then 
selects ОРК СМР mode via panel A8U and 
starts the sequence. The arm will fly from its 
current position to the desired end point and 
then stop. Should another sequence be desired, 
the operator would have to enter the new end 
point on the SPEC. 
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PDRS Caution and Warning Summary 


The RMS has a separate C/W matrix on 
panel A8U. This system is not associated 
with the orbiter’s C/W system. 


The red MCIU light indicates that the MCIU 
has failed a self-test. 


The red DERIGIDIZE light indicates that the 
end effector has derigidized without com- 
mand. 


The red ABE light indicates that a failure has 
occurred in the ABE of any joint. 


The red RELEASE light indicates that the end 
effector has released the grapple fixture 
without command. 


The red GPC DATA light indicates invalid 
data transmitted from the orbiter computer 
to the MCIU and detected by the MCIU BITE. 


The yellow CHECK CRT light indicates an 
RMS failure message is on the orbiter DPS 
display. 


The yellow CONTR ERR light indicates the 
presence of abnormal conditions in an arm- 
joint that may not be detected by BITE and 
may cause a joint runaway (software auto- 
matically applies the brakes when such a 
condition occurs). 


The yellow REACH LIM light indicates that 
one of the joints is close to its travel limit. 


The yellow PORT TEMP light indicates that 
the temperature of the port arm has exceeded 
its predetermined caution threshold. 


The yellow SINGULAR light indicates that 
the arm is in one of three singularity con- 
figurations. 


The red MASTER ALARM signals the RMS 
operator that an RMS C/W light was acti- 
vated. The light and tone are canceled by 
depressing the pushbutton. 


The RMS C/W tone volume may be adjusted 
by the CAUTION/WARNING TONE VOL- 
UME knob. 
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PDRS Summary Data 


e The PDRS is used to maneuver itself or an 
attached payload in orbit. It consists of the 
RMS, MPM, and MRLs, and interfaces with 
other orbiter systems such as the SM GPC, 
the EPDS, and the CCTV. 


e The RMS consists of the arm itself and the 
controls and interfaces needed to maneuver 
it. It is located on the port longeron. 


e The MPMs consist of the torque tube, the 
pedestals, the MRLs, and the jettison system. 
The MPMs must be stowed whenever the 
payload bay doors are closed. The port MPM 
must be deployed for any loaded operations. 
The starboard MPM differs from the port in 
having a pedestal where the port has the shoulder, 
and in the omission of the mid-pedestal. 


e The pedestals contain the MRLs and the 
jettison electronics and mechanism. They are 
the supports on which the RMS rests while it 
is cradled and the OBSS rests while it is berthed. 


e The MRLs latch the arm and OBSS to their 
respective MPMs and restrain them when not in 
use. 


е The jettison system allows the arm, the arm 
and pedestals, the arm/ payload 
combination, and/or the OBSS and pedestals to 
be non-impulsively separated from the 
orbiter if the arm cannot be cradled and 
stowed prior to payload door closure. 


The on-orbit arm operations fall into nine 
categories: — contingency-only ^ unloaded 
operations, unloaded operations, loaded op- 
erations, deploy operations, retrieve opera- 
tions, deploy and retrieve operations, station 
build operations, RMS/EVA operations, and 
OBSS operations. 


The arm has three basic modes of operation: 
single joint modes, manual-augmented 
modes, and auto modes. 


АП RMS operations involve a two-person 
operator team. Each member is vital to the 
success of the mission. 


The PDRS controls are located primarily on 
panels A8U апа A8L. Other panels that 
affect the RMS are ML86B, A14, A7U, А6, 
and R13. 


The major PDRS DPS display is SPEC 94 
PDRS CONTROL. PDRS OVERRIDE SPEC 
95, PDRS STATUS DISP 169, and PDRS 
FAULTS SPEC 96 also control and monitor 
the RMS. DISP 97 PL RETENTION monitors 
payload retention device status. 
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PDRS Rules of Thumb 


* Whenever there are both talkbacks and DPS 
displays that reflect microswitch status, they 
should ALWAYS both be checked during 
any operation affecting them. 


е Whenever troubleshooting RMS malfunc- 
tions in the long-form MAL book, always 
READ AHEAD. The MALs sometimes may 
require an operator response after the 
execution of the block which is listed in the 
next block, depending on the path that is 
taken. 


e The hand controllers are rate-proportional 
and are extremely sensitive. They should be 
held in such a way that you can control the 
full range of inputs without ever stopping to 
rearrange your hand. Care must be taken to 
not overcontrol the inputs. A good practice 
is to slowly and steadily input a desired 
command, wait patiently until you see the 
reactions of that command on the arm, and 
as the desired motion is achieved, slowly 
back off the input. Ideally, you should reach 
the axis detent at the same time the arm 
achieves the desired position and attitude. 


e Visible MPM motion may cease during 
deployment or stowage before the expected 
microswitches indications are received. This is 
because the last part of travel in either 
direction is when the affected overcenter lock 
is locking. Therefore, do not turn off the 
PORT RMS switch when visible motion 
stops. Wait for the microswitches or max 
time, whichever occurs first. 


e Practice safety habits, the most important of 
which are brakes on, then RMS Select off (if 
required) for abnormal joint response, and 
use the EE CC for abnormal EE ops during 
the specified conditions. 
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e During arm cradling, periodically check all 


joint angles to make sure that joints that you 
have already aligned to 0 have not moved. 


At least two good camera views should be 
set up to aid in RMS operations. However, 
CCTV cameras have а tendency to 
malfunction at the most inconvenient times. 
Expect this and know how to perform all 
operations with alternate cameras or without 
the use of certain cameras. Use the Grapple 
Target overlay during EE grapple operations. 


Develop a scan pattern that encompasses 
window, CCTV, and panel status. 


Always remember what the DAP should be 
for the operation you are performing. In 
addition, keep in mind the down mode 
option for the DAP in case the arm enters an 
unexpected singularity or reach limit. 


Never rotate the MODE switch through 
DIRECT while the brakes are on. This actu- 
ally puts the arm in mode, and sets you up 
for a possible runaway if а SINGLE/ DIRECT 
DRIVE switch failure occurs or is present. 


Verify the RATE switch setting by feel and 
talkback status. This should be done EVERY 
TIME prior to moving the arm, regardless of 
mode. 


Make sure you know the proper definitions 
of “cradling,” “stowing,” “berthing,” 
“mating,” and “installing.” 


Rates for berthing/unberthing: Usually 
maintain rates at about 0.01 to 0.02 ft/sec 
between Z = 414 and -438. For Z < -438 
(away from the bay), rates can be increased 
somewhat. 


For berthing or unberthing of payloads with 
keel trunnions: the keel pin enters/exits the 
AKA when the longeron trunnions are at the 
top of the built-in 8-inch PRLA guides. 
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Description 


The orbiter’s RCS consists of forward and aft 
control jets, propellant storage tanks, and 
distribution networks located in three vehicle 
modules: forward, left, and right. The forward 
module is contained in the nose area, forward 
of the cockpit windows. The left and right (aft) 
modules are collocated with the orbital 
maneuvering system (OMS) in the left and right 
OMS/RCS pods near the tail of the vehicle. 
Each RCS consists of high-pressure gaseous 
helium storage tanks, pressure regulation and 
relief systems, a fuel and oxidizer tank, a 
propellant distribution system, reaction control 
jets, and electrical jet and pod heaters. 


The RCS units provide propulsive forces from a 
collection of jet thrusters to control the orbiter’s 
motion. Each jet is permanently fixed to fire in 
a general direction: up, down, left, right, for- 
ward, or aft. The selective firing of individual 
jets or specific combinations of jets provides 
thrust for: 


e Attitude control 
® Rotational maneuvers (pitch, yaw, roll) 


• Small velocity changes along the orbiter 
axes (translational maneuvers) 


Each RCS jet is identified by the propellant 
manifold that supplies the jet and by the 
direction of the jet plume. The first identifier 
designates a jet as forward (F), left aft (L), or right 
aft (R) RCS. The second identifier, number 1 
through 5, designates the propellant manifold. 
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The third identifier designates the direction of 
the jet plume: A (aft), F (forward), L (left), R 
(right), U (up), D (down). For example, jets F2U, 
F3U, and F1U are forward RCS jets receiving 
propellants from forward RCS manifolds 2, 3, 
and 1, respectively; the jet plume direction is up. 


Forward RCS 
(16 jets) 


Left RCS 
(14 jets) 


Right RCS 
(14 jets) 
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Manual RCS use is accomplished through the 
rotational and translational hand controllers, 
and automatic use is handled by the digital 
autopilot (DAP) and the general purpose 
computers (СРС). 


Nominal uses of the RCS occur during ascent, 
orbit, and entry. During ascent, the RCS is used 
for rotational control during mated coast with 
the external tank. It is also used to provide -Z 
translation at external tank separation, using all 
10 down (-Z) primary jets. This is the only RCS 
translational maneuver done automatically. 
The RCS is also used during ascent to maneuver 
to OMS burn attitude and to trim residuals 
post-burn, if required. 


During orbit, the RCS provides attitude control, 
including pointing and attitude hold, and 
rendezvous maneuvers. 


During entry, the RCS provides for center of 
gravity (c.g.) management through the forward 
propellant dump. Also during entry, yaw, roll, 
and pitch control is provided by the aft 
left/right (Y) and up/down (2) jets. 


The RCS is also used during off-nominal 
situations. In the case of loss of two SSMEs on 
ascent, the OMS-to-RCS interconnect is 
automatically commanded, and the RCS 
provides single-engine roll control. If the OMS 
gimballing system is not performing adequately 
to control vehicle attitude during an OMS burn, 
RCS jets are used to help maintain attitude. 
This is also known as "RCS wraparound." The 
RCS is also used to adjust an orbit if the OMS 
fails prematurely. During aborts, the RCS may 
be used to assist with ascent propellant dumps 
to decrease vehicle weight, improve 
performance, and control center of gravity. 


NOTE 


RCS jets assist in OMS and/or RCS 
dumps by burning propellant in either 
propulsive or non-propulsive (null) 
burns. 


There are a total of 44 RCS jets; 38 primary and 
6 vernier. The vernier jets are only used on 
orbit for fine attitude control. The forward RCS 
has 14 primary and 2 side-firing vernier jets. 
The aft RCS has 12 primary and 2 vernier jets in 
each pod for a total of 28. One set of aft vernier 
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jets is side-firing, and the other set is down- 
firing. The primary RCS jets provide 870 
pounds of vacuum thrust each, and the vernier 
RCS jets provide 24 pounds of vacuum thrust 
each for precise maneuvering. The vernier jets 
are used for tight attitude dead bands and fuel 
conservation. 
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RCS Jet Identification 


NOTE 


The loss of one down-firing vernier jet 
results in the loss of the entire vernier 
mode due to the loss of control authority. 
If one side-firing vernier jet is lost, control 
can be maintained, except for some RMS- 
loaded operations. 


Two helium tanks supply gaseous helium pres- 
sure to the oxidizer and fuel tanks. The 
oxidizer and fuel are then supplied under 
pressure to the RCS jets. Nitrogen tetroxide 
(№204) is the oxidizer, and monomethyl 
hydrazine (ММН) is the fuel. The propellants 
are toxic, liquid at room temperature, and 
hypergolic (they ignite upon contact with each 
other). The propellants are supplied to the jets, 
where they atomize, ignite, and produce a hot 
gas and thrust. 


CAUTION 
On-orbit leak of MMH fuel may cause a 


module fire on entry when MMH mixes 
with atmospheric oxygen. 
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The primary jets are operable іп a maximum 
steady-state mode of 1 to 150 seconds, with a 
maximum single-mission contingency of 800 
seconds for the RCS aft (+X) jets and 300 sec- 
onds maximum for the RCS forward (-X) jets. 
The multiple primary jets provide redundancy. 
A single steady-state vernier firing of up to 275 
seconds in any 2-hour period is allowed. 
Vernier jets are used for finite maneuvers and 
stationkeeping (long-time attitude hold). The 
vernier jets are not redundant. 


The forward RCS module and OMS/RCS pods 
can be removed to facilitate orbiter turnaround, 
if required. 


Jet System 


The jet system combines fuel and oxidizer to 
produce hypergolic combustion (hot gas thrust). 
The system’s major components are the reaction 
jet driver, fuel and oxidizer valves, injector head 
assembly, combustion chamber, nozzle, and 
electrical junction box. 


The reaction jet driver converts GPC fire 
commands into the required voltage for 
opening the bipropellant valves, thus initiating 
the combustion process. The driver also 
generates chamber pressure discretes and sends 
them to redundancy management as an 
indication of actual jet firings. 


Each primary and vernier RCS jet has one fuel 
and опе oxidizer solenoid-operated pilot 
poppet valve that is energized open by an 
electrical thrust-on command, permitting the 
propellant hydraulic pressure to open the main 
valve poppet and allow the respective 
propellant to flow through the injector into the 
combustion chamber. When the thrust-on 
command 18 terminated, the valves are 
deenergized and closed by spring and pressure 
loads. 


The injector assembly directs the flow of 
propellants to the combustion chamber. The 
primary thrusters have injector hole pairs (one 
fuel, one oxidizer) called doublets, canted 
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toward each other for stream impingement of 
the propellants in the combustion chamber. 
Each primary jet has 84 doublets arranged in a 
“showerhead” circular pattern іп the 
combustion chamber. Additional fuel holes are 
provided near the outer edge of the injector 
assembly for cooling the combustion chamber 
walls. 


Each of the six vernier RCS jets has a single pair 
of fuel and oxidizer injector holes canted to 
cause impingement of the fuel and oxidizer 
streams for combustion. 


The combustion chamber of each RCS jet is 
constructed of columbium with a columbium 
disilicide coating to prevent oxidation. The 
nozzle of each RCS jet is tailored to match the 
external contour of the forward RCS module or 
the left and right aft RCS pods. The nozzle is 
radiation-cooled, and insulation around the 
combustion chamber and nozzle prevents the 
excessive heat of 2,000° to 2,400° F from 
radiating into the orbiter’s structure. 


The electrical junction box for each RCS jet has 
electrical connections for an electrical heater, a 
chamber pressure transducer, oxidizer and fuel 
injector temperature transducers (to detect 
propellant leaks) for each valve, and the 
propellant valves. 


There is a small possibility of random but 
infrequent combustion instability of the 
primary RCS jets, causing a burnthrough in the 
combustion chamber wall of an RCS primary jet 
in a very few seconds. An instability protection 
system is incorporated into each of the 38 
primary RCS jets. The electrical power wire of 
each primary RCS jet fuel and oxidizer valve is 
wrapped around the outside of each primary 
RCS jet combustion chamber wall. If instability 
occurs within a primary RCS jet the 
burnthrough would cut the electrical power 
wire to that primary RCS jet's valves, remove 
electrical power to the valves, close the valves, 
and render the jet inoperative for the remainder 
of the mission. 
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The system that distributes the propellants to 
the RCS jets consists of fuel and oxidizer tanks, 
tank isolation valves, manifold isolation valves, 
crossfeed valves, distribution lines, and filling 
and draining service connections. 


Propellant Tanks 


Each RCS module contains two propellant 
tanks, one for fuel and one for oxidizer. The 
nominal full load of the forward and aft RCS 
tanks in each pod is 1,464 pounds in the 
oxidizer tanks and 923 pounds in the fuel tanks. 


Each tank is pressurized with helium, which 
expels the propellant into ап internally 
mounted, surface-tension, propellant 
acquisition device that acquires and delivers the 
propellant to the RCS jets. The propellant 
acquisition device is required because of the 
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during entry. The device is also needed to deal 
with the various accelerations, which range from 
very high during ascent, entry, or abort to very 
low during orbital operation. The forward RCS 
propellant tanks have propellant acquisition 
devices designed to operate primarily in a low- 
gravity environment, whereas the aft RCS 
propellant tanks are designed to operate in both 
high and low gravity, ensuring adequate 
propellant flow during all phases of flight. A 
compartmental tank with individual wire mesh 
screen devices in both the upper and lower 
compartments supplies propellant independent 
of tank load or orientation. A barrier separates 
the upper and lower compartments in each 
tank. 


The aft RCS propellant tanks incorporate an 
entry collector, sumps, and gas traps to ensure 
proper operation during abort and entry 
mission phases. 
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The left, forward, and right RCS fuel and 
oxidizer tank ullage pressures (pressures within 
an RCS propellant tank used for expelling 
propellant and calculating propellant volume) 
can be monitored on panel ОЗ. When the left- 
hand rotary switch on panel O3 is positioned to 
RCS РКРІТ, the pressures are displayed on the 
three RCS/OMS/PRESS meters. The LEFT 
RCS, FWD RCS, or RIGHT RCS red caution and 
warning light on panel F7 will illuminate if a 
module's tank ullage pressure is less than 200 
psia or higher than 300 psia. 


RCS Propellant Quantity 


Тһе RCS quantity monitor uses the GPC to 
calculate the usable percent of fuel and oxidizer 
in each КС5 module. The quantities are 
computed based on the pressure, volume, and 
temperature method, which requires that 
pressure and temperature measurements be 
combined with a unique set of constants to 
calculate the percent remaining in each of the 
six propellant tanks. Correction factors are 
included for residual tank propellant at 
depletion, gauging inaccuracy, and trapped line 
propellant. The computed quantity represents 
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the usable (rather than total) quantity for each 
module and makes it possible to determine if 
the difference between each pair of tanks 
exceeds a preset tolerance (leak detection). 


The sequence assumes that helium flows to the 
propellant tanks to replace propellant leaving. 
As a result, the computed quantity remaining in 
a propellant tank will be decreased by normal 
usage, propellant leaks, or helium leaks. 


NOTE 


Erroneous temperature and/or pressure 
transducer readings will cause erroneous 
propellant quantity calculations. 


Тһе left, right, and forward RCS fuel and 
oxidizer quantities are displayed to the flight 
crew by the RCS/OMS PRPLT QTY LEDs on 
panel ОЗ. When the rotary switch on panel ОЗ 
below the LEDs is positioned to the RCS FUEL 
or OXID position, the LEDs will indicate, in 
percent, the amount of fuel or oxidizer. If the 
switch is positioned to RCS LOWEST, the 
gauging system selects whichever is lower (fuel 
or oxidizer) for display on the LED. 
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The left, right, and forward RCS quantities also 
are sent to PASS GNC SYS SUMM 2 (RCS L 
ОТҮ, К QTY, FWD QTY), and in the event of 
failures, substitution of alternate measurements 
and the corresponding quantity will be dis- 
played. If no substitute is available, the 
quantity calculation for that tank is suspended 
with a fault message. 


The sequence also provides automatic closure of 
the high-pressure helium isolation valves on 
orbit when the propellant tank ullage pressure 
is above 300 psia. When the tank ullage 
pressure returns below these limits, the close 
command is removed. 


2011/ /019 


GNC SYS SUMM 2 2 000/03:15:52 
ОМ$ АЕТ ОТҮ L R OMS 
OXID 30.2 230.2 
FU 30.2 30.2 


usa007587 734.tif 
PASS GNC SYS SUMM 2 Display 


Exceeding a preset absolute difference of 9.5 
percent between the fuel and oxidizer propel- 
lant quantities will illuminate the respective 
LEFT RCS, RIGHT RCS, or FWD RCS red cau- 
tion and warning light on panel F7, activate the 
BACKUP C/W ALARM, and cause a fault mes- 
sage to be sent to the DPS display. A bias of 9.5 
percent is added when a leak is detected so that 
subsequent leaks in that same module may be 
detected in the PASS. BFS will annunciate a 
leak only once. 


Tank Isolation Valves 


The valves located between the propellant tanks 
and the manifold isolation valves isolate the 
propellant tanks from the remainder of the pro- 
pellant distribution system. Тһе isolation 
valves are ac-motor-operated and consist of a 
lift-off ball flow control device and an actuator 
assembly that contains a motor, gear train, and 
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actuator gear. One pair of valves (one fuel and 
one oxidizer) isolates the propellant tanks from 
the 1/2 manifold (manifolds are referenced by 
number: 1/2/3/4/5) in the forward and aft left 
and right RCS. One pair of valves isolates the 
propellant tanks from the 3/4/5 manifold in the 
forward RCS. Two pairs of valves, in parallel, 
identified as A and B, isolate the propellant 
tanks from the 3/4/5 manifold in the aft left 
and right RCS. 


Ihe forward RCS tank isolation valves are 
controlled by the FWD RCS TANK ISOLATION 
1/2 and 3/4/5 switches on panel O8. The aft left 
RCS tank isolation valves are controlled by the 
AFT LEFT RCS TANK ISOLATION 1/2 and 3/4/5 
A and B switches on panel C7, and the aft right 
tank isolation valves are controlled by the AFT 
RIGHT RCS TANK ISOLATION 1/2 and 3/4/5 A 
and B switches on panel O7. These permanent- 
position switches have three settings: OPEN, 
GPC, and CLOSE. 


When the FWD RCS TANK ISOLATION 1/2 and 
3/4/5 switches on panel O8 are positioned open, 
fuel and oxidizer from the propellant tanks are 
allowed to flow to the corresponding manifold 
isolation valves. Electrical power is provided to 
an electrical motor controller assembly that 
supplies power to the ac-motor-operated valve 
actuators. Once the valve is in the commanded 
position, logic in the motor controller assembly 
removes power from the actuator. 


Microswitches in each pair of valves control 
talkback indicators above each tank's isolation 
switch on panel O8. The talkback indicator 
shows OP or CL when that pair of valves is 
open or closed and barberpole when the valves 
are in transit, or one valve is open, and the other 
is closed, or for some microswitch failures. The 
OPEN and CLOSE positions of the FWD RCS 
TANK ISOLATION 1/2 and 3/4/5 switches on 
panel OS8 permit manual control of the 
corresponding pair of valves. The GPC position 
is not supported in the Forward RCS. 


The OPEN, GPC, and CLOSE positions of the 
AFT LEFT RCS TANK ISOLATION 1/2 and 3/4/5 
A and B and AFT RIGHT RCS TANK 
ISOLATION 1/2 and 3/4/5 A and B switches on 
panel O7 are the same type as those of the 
forward RCS tank isolation switches and are 
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controlled electrically in the same manner. A 
talkback indicator above each switch indicates 
the position of the pair of valves as in the 
forward RCS. Тһе 344 А and В switches 
control parallel fuel and oxidizer tank isolation 
valves to permit or isolate propellants to the 
respective aft left and aft right RCS manifold 
isolation valves 3, 4, and 5. 


The aft tank isolation valves can be commanded 
open or closed when in the GPC position in OPS 
1,3 and 6 for auto-crossfeed purposes. 


Manifold Isolation Valves 


The forward RCS manifold isolation valves are 
between the tank isolation valves and the 
forward RCS jets. The valves for manifolds 1, 2, 
3, and 4 are the same type of ac-motor-operated 
valves as the propellant tank isolation valves 
and are controlled by the same type of motor- 
switching logic. The forward RCS manifold 
valve pairs are controlled by the FWD RCS 
MANIFOLD ISOLATION 1, 2, 3, 4, and 5 
switches on panel O8. Each MANIFOLD 
ISOLATION switch controls a pair of valves 
(one fuel and one oxidizer) which allow 
propellant to flow to the jets on the 
corresponding manifold. A talkback indicator 
above each of the five switches on panel O8 
indicates the status of that pair of valves. The 
talkback indicator is controlled in the same 
manner as the tank isolation valve indication. 
The OPEN and CLOSE positions of the switch 
permit control the corresponding oxidizer and 
fuel valves. Тһе GPC position is only 
supported in OPS 2 and 8. 


When the Shuttle is docked to the 155 (or any 
large payload) in OPS 2, a jet fail on could cause 
structural failure at the "joints" or to the less 
robust portions of the docked "stack" The 
GPCs can automatically close the affected 
manifold in OPS 2 or 8 if a jet fail on is 
annunciated, PROVIDED the AUTO MANF CL 
capability has been enabled via SPEC 23 and the 
switch is in the GPC position. 


NOTE 


The manifold isolation valves have a 
backflow capability when the manifold is 
closed, and the manifold pressure is 30 to 
50 psi higher than the tank leg. 


The FWD RCS MANIFOLD ISOLATION 5 
switch on panel O8 controls the manifold 5 fuel 
and oxidizer valves, which control propellants 
for the forward vernier RCS jets only. The 
switch is spring-loaded in the GPC position. 
When the switch is moved to the OPEN posi- 
tion, electrical power is momentarily applied 
through logic in an electrical load controller as- 
sembly to energize the solenoid valves open 
and magnetically latch the valves. To close the 
valves, electrical power is momentarily applied 
to energize the solenoids surrounding the mag- 
netic latches of the valves, which allows spring 
and propellant pressure to force the valves 
closed. A position microswitch in each valve 
indicates valve position to an electrical 
controller assembly and controls a talkback 
indicator above the switch. When both valves 
are open, the indicator shows OP; when both 
are closed, it indicates CL. If one valve is open, 
and the other is closed, the talkback indicator 
shows barberpole. 
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The AFT LEFT RCS MANIFOLD ISOLATION 1, 
2, 3, 4, 5 and AFT RIGHT RCS MANIFOLD 
ISOLATION 1, 2, 3, 4, 5 switches are on panel 
O7. The OPEN, GPC, and CLOSE positions of 
each switch are the same type as the forward 
switches and are controlled electrically in the 
same manner. The OPS 2 and 8 auto-manifold 
close capability for jet fail on is identical to the 
Forward RCS. The AFT LEFT and AFT RIGHT 
RCS MANIFOLD 1, 2, 3, and 4 switches provide 
corresponding tank propellants to Ње 
applicable primary RCS jets or isolate the 
propellants from the jets. The AFT LEFT and 
AFT RIGHT RCS MANIFOLD 5 switches 
provide corresponding tank propellants to the 
applicable vernier RCS jets or isolate the 
propellants from the jets. 


RCS Crossfeed Valves 


If either aft RCS pod’s propellant system must be 
isolated from its jets, the other aft RCS propellant 
system can be configured to crossfeed propellant. 
The aft RCS crossfeed valves that tie the crossfeed 
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manifold into the propellant distribution lines 
below the tank isolation valves can be configured 
so that one aft RCS propellant system can feed 
both left and right RCS jets. The aft RCS 
crossfeed valves are ac-motor-operated valve 
actuators and identical in design and operation to 
the propellant tank isolation valves. The aft RCS 
crossfeed valves are controlled by the AFT LEFT 
and AFT RIGHT RCS CROSSFEED 1/2 and 3/4/5 
switches on panel O7. The positions of the four 
switches are OPEN, GPC, and CLOSE. The GPC 
position allows the orbiter computer to 
automatically control the crossfeed valves, and 
the OPEN and CLOSE positions enable manual 
control. The OPEN position of the AFT LEFT 
RCS CROSSFEED 1/2 and 3/4/5 switches 
permits the aft left RCS to supply propellants to 
the aft right RCS crossfeed valves, which must 
be opened by placing the AFT RIGHT RCS 
CROSSFEED 1/2 and 3/4/5 switches to the OPEN 
position for propellant flow to the aft right RCS 
jets. (Note that the AFT RIGHT receiving RCS 
TANK ISOLATION 1/2 and 3/45 A and B valves 
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must Бе closed.) Тһе CLOSE position of the 
AFT LEFT and AFT RIGHT RCS CROSSFEED 
1/2 апа 3/4 switches isolates the crossfeed 
capability. The crossfeed of the aft right RCS to 
the left RCS would be accomplished by 
positioning the АРГ RIGHT and LEFT RCS 
CROSSFEED switches to OPEN and positioning 
the AFT LEFT RCS TANK ISOLATION 1/2 and 
3/4/5 A, B switches to CLOSE. 


Helium System 


Each RCS has two helium storage tanks, four 
helium isolation valves, four pressure regula- 
tors, two check valves, two relief valves, and 
servicing connections for draining and filling. 


Helium Tanks 


The two helium tanks in each RCS supply gase- 
ous helium individually, one to the fuel tank 
and one to the oxidizer tank. 


NOTE 


The helium tanks provide ullage pressure 
for the propellant tanks. Each propellant 
tank has a specific quantity where, should 
the helium tank fail, the nominal ullage 
pressure would result in the maximum 
delta V. This quantity is referred to as 
max blowdown. Max blowdown for the 
forward RCS is 22 percent; for the aft 
RCS, it is 24 percent propellant quantity 
remaining. 


Helium Isolation Valves 


Two parallel helium isolation valves are located 
between the helium tanks and the pressure 
regulators in each RCS. When open, the helium 
isolation valves permit the helium source 
pressure to flow to the propellant tank. The 
helium isolation valves are controlled by the 
FWD RCS He PRESS A and B switches on panel 
O8 and the AFT LEFT RCS He PRESS A and B 
and AFT RIGHT RCS He PRESS A and B 
switches on panel O7. Each switch controls two 
helium isolation valves, one in the oxidizer 
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helium line and one in the fuel helium line. The 
switch positions are OPEN, GPC, and CLOSE. 
When the switch is positioned to GPC, the pair 
of valves can be closed automatically upon 
command from the orbiter computer. The 
OPEN/CLOSE positions permit manual control 
of that pair of valves. 


Electrical power is momentarily applied 
through logic in an electrical load controller 
assembly to energize the two helium isolation 
solenoid valves open and to magnetically latch 
the valves open. To close the two helium 
isolation valves, electrical power is momentarily 
applied through the load controller to energize a 
solenoid surrounding the magnetic latch of the 
two helium isolation valves, which allows spring 
and helium pressure to force the valve closed. 


A position microswitch in each valve indicates 
valve position to an electrical controller assem- 
bly and controls a position indicator (talkback) 
above each switch on panels O7 and О8. When 
both valves (helium fuel and helium oxidizer) 
are open, the talkback indicates OP; when both 
valves are closed, the talkback indicates CL. If 
one valve is open, and the other is closed, the 
talkback indicates barberpole. 


The RCS helium supply pressure is monitored 
on panel ОЗ. When the rotary switch on panel 
O3 is positioned to RCS He X10, the forward 
and aft RCS helium pressures are displayed on 
the RCS/OMS/PRESS OXID and FUEL meters 
on panel O3. 


Helium Pressure Regulators 


Helium pressure is regulated by two regulator 
assemblies, connected in parallel, downstream 
of the helium isolation valves. Each assembly 
contains two stages, a primary and a secondary, 
connected in series. If the primary stage fails 
open, the secondary stage regulates the pres- 
sure. The primary regulates the pressure at 242 
to 248 psig, the secondary at 253 to 259 psig. 
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Check Valves 


The check valve assembly, which consists of 
four poppets in a series-parallel arrangement, is 
located between the pressure regulator 
assemblies and the propellant tank. The series 
arrangement limits the backflow of propellant 
vapor and maintains propellant tank pressure 
integrity in the event of an upstream helium 
leak. The parallel arrangement ensures the flow 
of helium pressure to the propellant tank if a 
series check valve fails in the closed position. 


Pressure Relief Valve 


A helium pressure relief valve assembly located 
between the check valve assemblies and pro- 
pellant tank will vent excessive pressure over- 
board before it reaches the propellant tank. 
Each valve consists of a burst diaphragm, filter, 
and relief valve. The non-fragmentation dia- 
phragm, which provides a positive seal against 
helium leakage, will rupture between 324 and 
340 psig. The filter prevents any particles of the 
burst diaphragm from reaching the relief valve 
seat. The relief valve relieves at 315 psig mini- 
mum and reseats at 310 psig. The relief valve is 
sized to handle, without damaging the propel- 
lant tank, helium pressure flow volume if a 
regulator malfunctions to a full-open position. 


Thermal Control 


Electrical heaters are provided in the forward 
RCS module and the OMS/RCS pods to 
maintain the propellants in the module and 
pods at safe operating temperatures and to 
maintain safe operating temperatures for the 
injector of each primary and vernier RCS jet. 


Each primary RCS jet has a 20-watt heater, 
except the four aft-firing jets, which have 30- 
watt heaters. Each vernier RCS jet has a 10-watt 
heater. 


The forward RCS has six heaters mounted on 
radiation panels in six locations. Each 
OMS/RCS pod is divided into nine heater 
zones. Each zone is controlled in parallel by an 
A and B heater system. The aft RCS jet housing 
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contains heaters for the yaw, pitch up, pitch 
down, and vernier jets in addition to the aft 
OMS/RCS drain and purge panels. 


The forward RCS panel heaters are controlled 
by the FWD RCS switch on panel А14. When 
the switch is positioned to A AUTO or B AUTO, 
thermostats on the forward left-side panel and 
right-side panel automatically control the re- 
spective forward RCS heaters. When the re- 
spective forward RCS panel temperature 
reaches a minimum of approximately 55° F, the 
respective panel heaters are turned on. When 
the temperature reaches a maximum of ap- 
proximately 75° F, the heaters are turned off. 
The OFF position of the switch removes all 
electrical power from the forward RCS heaters. 


The aft RCS heaters are controlled by the LEFT 
POD A AUTO and B AUTO and RIGHT POD A 
AUTO and B AUTO switches on panel А14. 
When the switches are positioned to either A 
AUTO or B AUTO, thermostats automatically 
control the nine individual heater zones in each 
pod. Each heater zone is different, but 
generally the thermostats control the 
temperature between approximately 55° F 
minimum to approximately 75° F maximum. 
The OFF position of the respective switch 
removes all electrical power from that pod 
heater system. 


The forward and aft RCS primary and vernier 
jet heaters are controlled by the FWD and AFT 
RCS JET 1, 2, 3, 4, and 5 switches on panel A14. 
When the switches are positioned to AUTO, 
individual thermostats on each jet automatically 
control the individual heaters on each jet. The 
primary RCS jet heaters turn on between 
approximately 66° to 76° F, and they turn off 
between approximately 94° to 109° Е. The 
vernier RCS jet heaters turn on between 
approximately 140° to 150° F and off between 
approximately 184° to 194° F. The OFF position 
of the switches removes all electrical power 
from the jet heaters. The 1, 2, 3, 4 and 5 
designations refer to propellant manifolds. 
There are two to four jets per manifold. 
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RCS Redundancy Management 


RCS redundancy management (RM) software 
includes RCS jet failure detection and 
annunciation, jet availability, SPEC 23 RCS, 
SPEC 51 BFS OVERRIDE, and manifold status 
processing. 


Jet failure modes detected and annunciated are 
fail-off,  fail-on, апа fail-leak. Fault 
annunciation is a class 2 alarm consisting of a 
master alarm, illumination of the yellow RCS 
JET and red BACKUP C/W ALARM lights on 
panel F7, and a fault summary message (F (L,R) 
RCS A (D, К, О) JET). 


All statuses, flags, counters, and related RCS 
RM data are carried across OPS transitions. 
However, when BFS is engaged, all flags, 
statuses, and counters are cleared and 
reinitialized. 


The jet parameters used in RM are the Pc 
discrete, CMD B, driver out discrete, and the 
oxidizer and fuel injector temperatures. Рс 
discrete is turned on when the jet chamber 
pressure reaches 36 psi and remains on until the 
chamber pressure falls below 26 psi. Individual 
fail detection and response parameters are as 
follows. 
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SPEC 51 BFS OVERRIDE Display 
Jet Fail-Off 
Detection: 


е CMD B present with no Pc Discrete for 
three consecutive cycles. 


е RM is suspended for ап MDM or LRU 
commfault. 


е RM is unable to detect а fail-off jet when 
the Pc transducer is failed high. 


RM Response: 
e Fail-off flag is set. 
* Message is annunciated. 


е Jet is deselected unless the pod limit has 
been reached. 
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Jet Ғай-Оп 


Detection: 


e Driver out discrete is present when a 
CMD B is not issued for three consecu- 
tive cycles. 


е RM is suspended for an MDM or LRU 
commfault. 


е RM is unable to detect а fail-on jet when 
the driver out discrete is failed low. 


RM Response: 
e Fail-on flag is set. 
* Message is annunciated. 


е In OPS2 (8) a closed command is sent to 
the affected manifold valves if AUT 
МАМЕ CL is enabled. 
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Detection: 


e Either oxidizer or fuel injector tempera- 
ture is below the RCS КМ injector 
temperature limit for three consecutive 
cycles. 


е RM is suspended for an MDM or LRU 
commfault. 


е RM is unable to detect a fail-leak jet for 
a failed-high temperature transducer. 


e A failed-low injector temperature trans- 
ducer will trip RM. 


RM Response: 
• Fail-leak flag is set. 
• Message is annunciated. 


е Jet is deselected unless the pod limit has 
been reached. 


Once RM has annunciated a failure for a jet, that 
failure will not be reannunciated until the fail 
flag is reset. The remaining failure modes that 
were not detected can be annunciated. Vernier 
jet failures are annunciated in OPS 2 and 8 only. 
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RCS Redundancy Management Schematic 


Nomenclature 


To clarify nomenclature, a few RCS RM 
definitions are listed below. 


Deselected Jet — A jet that is not available and 
will not be commanded to fire. 


Reselected Jet — A jet that was previously not 
available and is now available and could be 
commanded to fire. 


Auto-Deselected Jet — A jet that has been 
deselected by RCS RM software. RM will auto- 
deselect a jet for fail-off and fail-leak detection. 


Manually Deselected Jet — A jet that has been 
deselected by SPEC 23 item entry. 


Manually Reselected Jet — A jet that is 
reselected via SPEC 23 item entry. This is the 
only method to reselect an individual jet that 
was auto-deselected by RCS RM. (A whole 
manifold of jets can be reselected via SPEC 51 
and SPEC 23 item entry.) 
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Pod Counter — The internal RCS RM counter 
that counts the number of jets per pod that have 
been auto-deselected by RCS RM. 


Pod (Fail) Limit — The PRI JET FAIL LIM on 
SPEC 23 (item 4) that limits the number of 
primary jets that can be auto-deselected per 
pod. 


Pod Counter is Full — Pod counter equals pod 
fail limit. Typically, this means two jets have 
failed and have been auto-deselected т a pod. 


Override a Manifold Open (Closed) — An 
action performed via item entry on SPEC 23 that 
toggles the RCS RM manifold status to open 
(closed). The КС5 RM manifold status is an 
independent variable that may differ from the 
actual manifold valve position. Overriding a 
manifold closed will deselect all the jets on that 
manifold. 


Deselection Candidate — Апу jet that is 
annunciated fail-off or fail-leak by КС5 RM 
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becomes а deselection candidate, unless the jet 
has been deselect inhibited. 


Jet Availability Table — Ап array that contains 
a bit for each jet. The bit is on if the associated 
jet is available and may be commanded to fire 
by DAP. The bit is off when the jet is not 
available as determined by КС5 RM. 
Unavailable jets will not be commanded to fire. 


Jet Pod Counter and Pod Limit 


RCS SPEC 23 displays the PRI JET FAIL LIM. 
This limit is the number of primary jets that RCS 
RM will deselect for the pod (forward, left, or 
right) currently displayed on SPEC 23. This 
number is 
I-Ioaded to 2 and can be changed via SPEC 23. 


RCS RM will auto-deselect primary jets until the 
pod counter equals the pod limit. RM will 
continue to annunciate all jet failures not 
previously annunciated when the pod counter 
is full; however, no new jets will be auto- 
deselected. 


Manually reselecting an auto-deselected jet will 
reduce the pod counter by one. Manually 
reselecting a jet that was manually deselected 
via SPEC 23 will not have an impact on the pod 
counter. 


The pod counter is not affected by subsequent jet 
failures оп а previously deselected jet. 
Decreasing the pod limit does not reselect jets. If 
the pod limit is at two, and two jets are currently 
auto-deselected, changing the limit to one will 
not reselect one of the auto-deselected jets. 


Once a jet is annunciated fail-off or fail-leak, 
that jet is a deselection candidate. Assume the 
pod limit is two. If the pod counter is full, and a 
third (or more) jet becomes a deselect candidate, 
this jet will not be auto-deselected, as expected. 
If one of the jets on the same pod is then manu- 
ally reselected, the pod counter is decremented 
to one, also as expected. However, the deselec- 
tion candidate that could not previously be 
auto-deselected since the pod counter was at the 
limit will now be auto-deselected, and the pod 
counter will be incremented to two again. All 
deselect candidates remain "deselectable" until 
their fail-flags are cleared. 
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RCS Manifold RM 


RCS RM contains an independent evaluation of 
RCS manifold valve status. Input to this 
processing includes the actual manifold valve 
status, commfault protection, and crew display 
item entry processing. The RCS RM manifold 
status can differ from the actual valve positions. 
Manifold status is reevaluated when valve 
discretes change, a commfault occurs, or 
manifold status is changed by crew display item 
entries. A commfault is declared when the data 
path for the manifold valve microswitch 
discrete is failed. A commfault occurs when an 
MDM or GPC fails, or a BCE BYPASS is 
declared. 


If RCS RM sets the manifold status to closed, all 
jets on the affected manifold will be removed 
from the availability table. Manifold status is 
set to closed by RCS RM in four cases: 
manually closing the valve, commfault, crew 
display item entry, and some dilemma cases. 


RCS RM will set the manifold status to closed 
for MDM commfaults on the associated 
microswitch channelization. An I/O RESET 
will force RCS RM to reevaluate the manifold 
status. Thus, if an I/O RESET clears the 
commfault, the manifold status will be set to 
open. 


Crew item entries on SPEC 23 can toggle a 
manifold status open or closed. 


RCS Manifold RM can detect two failure modes: 
power fail and dilemma. Input to these failure 
detection processes are the four manifold 
microswitch discretes: OX OP, OX CL, FU OP, 
and FU CL. 


Actual electrical bus voltages are not used in 
power fail determination. The manifolds are 
paired by common microswitch buses, and 
power fails are issued only if both manifolds 
indicate loss of power to their microswitches. 


RCS RM Manifold Dilemma 


Detection — Three cases of microswitch 
indications result in an RCS RM manifold 
dilemma: 


e 1OP indication + 1 or 0 CL indications 


e 2OP indications + 2 CL indications 
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e 0 OP indications + 0 CL indications 
(FRCS manifolds 1, 2, 4, and 5 only) 


Indications can be ОХ and/or FU 
microswitches. These conditions must exist for 
three consecutive passes. 


RM Response — Issue “RCS RM DLMA" 


message. 


In summary, if the number of open indications 
is greater than the number of closed indications, 
the manifold status is open; otherwise, the 
manifold status is closed. 


RCS Manifold Power Fail 


Detection — All four manifold microswitch 
discretes are 0 for six consecutive passes. 
Power fail processing is performed on the 
following manifold pairs: ЕКС5 M3/4, ARCS 
L1/R1, L2/ R2, L3/ КЗ, L4/R4, and L5/ R5. 


RM Response — Issue "RCS PWR FAIL" 
message. Manifold status is unchanged. 


Forward manifolds 1, 2, and 5 are not analyzed 
for power fail conditions. Ш these manifolds 
suffer a power fail to their microswitches, an 
^RCS RM ОГМА” will be issued, rather than an 
^RCS PWR FAIL." 


Forward manifold 3  microswitches аге 
redundantly powered by MN A FPC1 and MN 
C FMC3. Forward manifold 4 microswitches 
are powered only by MN C FMC3. Both MN A 
ЕРСІ and ММС FMC3 must be lost for RCS RM 
to issue a power fail for this manifold pair. 
Because of the low probability of this case, 
forward manifold 3/4 power fails are rarely 
detected. However, for the loss of MN C FMC3, 
an “RCS RM DLMA” message is annunciated, 
FRCS manifold 4 is declared closed, and the 
associated jets are declared unavailable. 


Jet Selection 


The DAP jet-select module contains default logic 
in certain instances. When the orbiter is mated to 
the ET, roll rate default logic inhibits roll rotation, 
and yaw commands are normally in the direction 
of favorable yaw-roll coupling. During insertion, 
a limit of seven aft RCS jets per tank set applies 
for ET separation and for return-to-launch-site 
aborts. If negative Z and plus X translation 
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commands are commanded simultaneously, both 
will be degraded. A limit of four aft RCS jets per 
tank set normally applies. If plus X and negative 
Z translations are commanded simultaneously, 
plus X is given priority. Multi-axis translation 
and rotation commands may require more jets 
than allowed and result in degraded control and 
excessive propellant usage. The DAP jet-select 
module determines which aft RCS jets (right, 
left, or both) must be turned on in response to 
the pitch, roll, and yaw jet commands from the 
entry flight control system. The forward RCS 
jets are not used during entry. After entry 
interface, only the four Y-axis and six Z-axis 
RCS jets on each aft RCS pod are used. No 
X-axis or vernier jets are used. The DAP sends 
the discretes that designate which aft RCS jets 
are available for firing (a maximum of four RCS 
jets per pod may be fired). During 
reconfiguration, or when the RCS crossfeed 
valves are open, the DAP determines the 
maximum combined total number of yaw jets 
available during certain pitch and roll 
maneuvers. 


During ascent or entry, the DAP jet-select logic 
module in the flight control system receives 
both RCS rotation and translation commands. 
By using a table lookup technique, the module 
outputs 38 jet on/off commands to the RCS 
command subsystem operating program, which 
then generates dual fire commands A and B to 
the individual RCS reaction jet drivers to turn 
each of the 38 primary RCS jets on or off. The 
fire commands A and B for each of the 38 
primary RCS jets are set equal to the digital 
autopilot RCS commands. Commands are 
issued to the six RCS vernier jets similarly 
on orbit. 


Jet Fire Indications 


ROLL, PITCH, and YAW white indicator lights 
on panel F6 indicate the presence of an RCS 
command during orbit and early entry. The 
indicators are L and R for roll and yaw left or 
right and U and D for pitch up and down. 


From entry interface until the dynamic pressure 
is greater than 10 pounds per square foot, the 
ROLL L and ROLL R lights indicate that left or 
right roll commands have been issued by the 
digital autopilot. The minimum light-on 
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duration is extended to allow the light to be 
seen even for a minimum impulse firing. When 
a dynamic pressure of 10 pounds per square 
foot has been sensed, neither ROLL light will be 
illuminated until 50 pounds per square foot has 
been sensed, and more than two RCS yaw jets 
are commanded on. 


Jet Fire Indicator Lights on Panel F6 


The PITCH lights indicate up and down pitch jet 
commands until a dynamic pressure of 20 
pounds per square foot is sensed, after which the 
pitch jets are no longer used. When 50 pounds 
per square foot is sensed, the PITCH lights 
assume a new function. Both PITCH lights will 
be illuminated whenever the elevon surface drive 
rate exceeds 20° per second (14° per second if 
only one hydraulic system is remaining). 


The YAW lights function as yaw jet command 
indicators throughout entry until the yaw jets 
are disabled at Mach 1 (approximately 45,000 
feet). The YAW lights have no other function. 


Operations 


After main engine cutoff, the forward and aft 
jets are used to maintain attitude hold until 
external tank separation. Then the RCS 
provides a negative Z translation maneuver of 
about 4 feet per second to move the orbiter 
away from the external tank. Upon completion 
of the maneuver, the RCS holds the orbiter 
attitude until it is time to maneuver to the OMS- 
2 burn attitude. Although the targeting data for 
the OMS-2 burn are selected before launch, the 
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target data in the onboard general-purpose 
computers can be modified by the flight crew 
via the DPS and keyboard, if necessary, before 
the OMS burn. 


The OMS-2 burn uses both OMS engines to 
raise the orbiter to a predetermined circular 
orbit. (OMS-1 burns are only planned for 
standard insertions.) During the OMS-2 burn, 
vehicle attitude is maintained by gimbaling 
(swiveling) the OMS engines. The RCS 
normally does not operate during an OMS burn. 
If, during an OMS burn, the gimbal rate or 
gimbal limits are exceeded, RCS roll control 
would be required; or if only one OMS engine is 
used during a burn, RCS roll control may be 
required. 


Upon completion of the OMS-2 burn, the RCS 
can be used to null any residual velocities, if 
required. It is then used for attitude hold and 
minor translation maneuvers as required for on- 
orbit operations. The flight crew can select 
primary or vernier RCS jets for attitude control 
in orbit. Normally, the vernier jets are selected 
for on-orbit attitude hold. 


On orbit, the vernier jets are used for fine attitude 
control, and the primary jets are used for coarse 
attitude control and minor translations. 


Before the deorbit burn, the flight crew 
maneuvers the spacecraft to the desired attitude 
using RCS jets. After the OMS burn, the RCS is 
used to null any residual velocities, if required. 
The spacecraft is then maneuvered to the proper 
entry interface attitude using the RCS. The 
remaining propellants aboard the forward RCS 
may be dumped by burning the propellants 
through the forward RCS yaw jets before entry 
interface if orbiter center-of-gravity control is 
necessary. 


The RCS aft (+ X) jets can be used to complete 
any OMS deorbit burn if an OMS engine fails. 
In this case, the OMS-to-aft-RCS interconnect 
can be used to feed OMS propellant to the aft 
RCS. 


From an entry interface of 400,000 feet, the 
orbiter is controlled in roll, pitch, and yaw with 
the aft RCS jets. The orbiter’s ailerons are used 
starting at a dynamic pressure (q-bar) of 2 
pounds per square foot (psf), and the aft RCS 
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roll jets are deactivated at a q-bar of 10 psf. Ata (-Баг of 40 psf. The rudder is activated at Mach 
q-bar of 2 psf, the orbiter's elevons are active, 5.0, and the aft RCS yaw jets are deactivated at 
and the aft RCS pitch jets are deactivated ata Mach 1 (approximately 45,000 feet). 
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RCS Caution and Warning Summary 


There are class 2 and 3 alerts for the RCS. 


Class 2 alerts can occur in all the OPS and 
generate a MASTER ALARM light and tone 
and a light on the Caution and Warning 
matrix on panel F7. 


A class 3 alert is generated by the primary 
GNC or SM software in OPS 2 and 8 or by 
the BFS software in other OPS. 


The red LEFT RCS, FWD RCS, or RIGHT RCS 
light will illuminate if propellant tank ullage 
pressure is less than 200 psia or higher than 
312 psia. Exceeding a preset difference of 9.5 
percent between fuel and oxidizer propellant 
quantities will also illuminate the 
appropriate one of these lights, activate the 
BACKUP C/W ALARM, and send a fault 
message to the DPS display. 


RCS jet failure illuminates the yellow КС$ 
JET and red BACKUP C/W ALARM lights 
and sends a fault message to the DPS 
display. 


An F(L,R) RCS X JET (where X-U,D,L,R,F or 
A) fault message will be displayed in the 
PASS when a jet fail ON, jet fail OFF, or jet 
fail LEAK occurs. (OPS 1,2,3,6,8) 


An F(LR) JET fault message will be 
displayed in the BFS when a jet fail ON or jet 
fail OFF occurs when the BFS is engaged. 
(OPS 1,3,6) 


An F(LR) He P fault message will be 
displayed when helium pressure (FU or OX) 
in the affected pod is below 500 psi. (PASS 
OPS 2,8; BFS OPS 1,3,6) 


An F(L,R) RCS LEAK fault message will be 
displayed when propellant quantities (FU 
and OX) in any one pod differ by more than 
9.5 percent. (PASS OPS 2,3,8; BFS OPS 1,3,6) 
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An F(L,R) RCS PVT fault message will be 
displayed in the PASS when there is loss of 
pressure or temperature data that is needed 
for RCS quantity calculations. (OPS 2,3,8) 


An F(L,R) RCS TK P fault message will be 
displayed when propellant tank pressure 
exceeds upper (312 psi) or lower (200 psi) 
limits. (PASS OPS 2,8; BFS OPS 1,3,6) 


A G23 RCS SYSTEM F(L,R) fault message 
will be displayed in the PASS when propel- 
lant tank outlet pressure exceeds upper (300 
psi) or lower (220 psi) limits or propellant 
tank temperature exceeds upper (90° F) or 
lower (50° F) limits. (OPS 2,8) 


An RCS PWR FAIL fault message will be dis- 
played in the PASS when there is loss of 
valve logic power to the manifold isolation 
valves. (OPS 1,2,3,6,8) 


An КМ DLMA МАМЕ fault message will be 
displayed in the PASS when a dilemma is 
detected in the manifold valve status (FU and 
OX valve positions disagree). (OPS 1,2,3,6,8) 


An S89 PRPLT THRM RCS fault message 
will be annunciated when the temperature in 
the affected structure exceeds I-loaded upper 
or lower limits. (OPS 2) 
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RCS Summary Data 


2. SYSTEMS 


The RCS consists of forward and aft systems 
of control jets, propellant storage tanks, and 
distribution networks located in three sepa- 
rate vehicle modules. 


The forward module is in the nose area, and 
the left and right aft modules are in the left 
and right OMS/RCS pods near the tail of the 
vehicle. 


The forward RCS has 14 primary and two 
vernier jets; the aft RCS has 12 primary and 
two vernier jets per pod. 


Primary jets provide 870 pounds each of vac- 
uum thrust; vernier 24 each. The vernier jets 
are only used on orbit for fine attitude 
control. 


Each jet is permanently fixed to fire in a gen- 
eral direction. The selective firing of 
individual jets or combinations of jets pro- 
vides thrust for attitude control, rotational 
maneuvers, and translational maneuvers. 


Manual RCS use is through the rotational 
and translational hand controllers, and 
automatic use is handled by the digital 
autopilot апа Ње general purpose 
computers. 


Nominal uses of the RCS include mated 
coast, ET separation, and trim residuals dur- 
ing ascent; attitude control and maneuvers in 
orbit; and entry flight control and center of 
gravity management. 


Off-nominal uses include single-engine roll 
control, RCS wraparound during OMS burn, 
OMS completions, and abort dumps. 


RCS jets are fueled with МО and MMH. 
The propellants are liquid at room 
temperature and hypergolic. 


Propellant quantities are monitored on panel 
ОЗ. 


Most RCS control switches are distributed 
over panel O7 and O8. 


Thermal control switches are located on 
panel А14. 


RCS information display and control is 
through the GNC SYS SUMM 2 and SPEC 23 
RCS displays. 
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RCS Rules of Thumb 


1% RCS prop = 1 fps АУ. 
1% RCS prop = 22 lb. 


1,000 lbs of ARCS prop moves X c.g. 12. in, Y 
c.g. + 0.4 in. 


1,000 Ibs of FRCS prop moves X c.g.-3.5 in. 
ARCS max blowdown qty 24%. 
FRCS max blowdown qty 22%. 


Loss of a single downfiring vernier jet is loss 
of vernier mode. 


If fuel tank pressure is 20 psi higher than the 
oxidizer tank pressure, then verniers are no- 


go. 


Always secure the RCS from the manifolds 
up to the helium tanks. 


Always open the RCS from the helium tanks 
down to the manifolds. 


A momentary barberpole talkback may be 
seen when adjacent “A” or “B” RCS helium 
isolation valves are operated due to vibration 
form the operating valve. 
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Description 


The Spacehab module is a pressurized experi- 
ment carrier designed to augment space shuttle 
middeck experiment accommodations and to 
provide a pressurized volume for logistics 
transfer to the International Space Station (155). 
Тһе Spacehab system consists of a module 
flown in the orbiter payload bay that is 
configured with middeck-type lockers, racks, 
and/or the logistics transportation system (LTS) 
to accommodate a variety of experiments and 
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space for crewmembers to work on experiments 
in a shirt-sleeve environment. Spacehab offers 
the Space Shuttle Program several module 
configurations to accommodate mission-specific 
requirements. 


Configurations 


All Spacehab configurations are connected to 
the orbiter with standard orbiter payload 
support resources from the cabin and payload 
bay. The Spacehab module provides 
crewmembers with a place to carry logistics 
and/or experiments and contains cooling, 
power, and command and data provisions, in 
addition to Spacehab housekeeping systems 
(i.e., power distribution and control, lighting, 
fire and smoke detection, fire suppression, 
atmosphere control, status monitoring and 
control, and thermal control). 


The Spacehab configuration for logistics 
mission to the ISS allows the Spacehab single 
module to be mounted in a trunnion location to 
accommodate the orbiter docking system (ODS) 
in the forward payload bay. The module is 
connected to the ODS using a Spacehab tunnel 
adapter with extravehicular activity (EVA) 
hatch, and a Spacehab tunnel segment. 


equipment. The Spacehab module provides 
STB 
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Flight Deck Interfaces 


Several panels located on the flight deck allow 
the crew to control and monitor Spacehab 
subsystems operations. Those interfaces are 
listed below with brief descriptions of their 
primary functions. 


R1 Panel 


• Тһе КІ panel controls the connection of 
main dc power to the Spacehab via the 
primary payload bus. 


e The КІ panel controls the connection of 
essential and emergency power to the 
Spacehab via auxiliary payload bus and 
aft payload B bus. 


е Тһе КІ panel controls the connection of 
aft flight deck ас power (cabin payload) 
to the Spacehab for system operations. 


L1 Panel 


® The L1 panel controls the distribution of 
orbiter Freon flow to the payload heat 
exchanger to support Spacehab thermal 
load requirements. 


C3A5 


e The C3A5 panel provides controls to 
activate the Spacehab fire suppression 
subsystem (FSS) and Н,О line heaters. 


IDP 


e The orbiter DPS display allows the crew 
to monitor and control Spacehab subsys- 
tems via the Spacehab displays and 
SPECs (BFS display 206 SH Launch/ 
Entry, SM SPEC 214 SH ACT/DEAC, 
and SM SPEC 215 SH ECS). 


L12 Panel 


e The L12 panel consists of the standard 
switch panel (SSP) configurations to 
support Spacehab activation, control, 
and monitoring. 
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Command and Data Subsystem 


The Spacehab command and data subsystem 
(CDS) receives hardwired commands from the 
orbiter SSP and Spacehab monitor and control 
panel (MCP). The CDS can receive commands 
for Spacehab subsystem апа experiment 
activation and deactivation from either ground 
uplink or the orbiter DPS via the payload signal 
processor (PSP) link. The Spacehab can also 
receive commands from an orbiter-provided 
microcomputer, the payload general support 
computer (PGSC). The PGSC commanding 
capability can be used only to command the 
Spacehab video switching unit (VSU). 


The data management unit (DMU) is the major 
element of the Spacehab CDS. The DMU pro- 
vides data acquisition and command functions for 
the Spacehab module. The DMU also provides all 
serial interfaces required for data transmission 
between the Spacehab module and the orbiter. 


The payload data interleaver (PDI) interface to 
the DMU gives ground controllers the 
capability to monitor Spacehab subsystem and 
experiment telemetry. 


Caution and Warning 


The orbiter caution and warning (C&W) system 
and Spacehab subsystems work together to alert 
the crew if Spacehab subsystem equipment is 
failing. When an alarm condition is detected, 
the orbiter provides a signal that activates the 
master alarm light in the Spacehab module. 


Тһе Spacehab C&W subsystem is defined in 
three groups: 


® Class 1, Emergency C&W 


e Class 2, Hardware C&W/software 
C&W 

e Class 3, Fault detection annunciation 
(FDA) 


Electrical Power Subsystem 


The Spacehab electrical power subsystem (EPS) 
distributes direct current, alternating current, 
and emergency current sources to subsystems 
and experiment equipment. Main power is dis- 
tributed via the power distribution unit (PDU). 


2.23-2 


The PDU is the major component of the Space- 
hab EPS. The PDU receives and distributes 
main dc, secondary dc, and 3-phase 115-volt ac 
power from the orbiter. Also, the PDU distrib- 
utes Spacehab  inverter-generated, 3-рһаве 
115-volt ac power to subsystem and experiment 
equipment. 


The emergency power received from both the 
orbiter auxiliary A and aft payload B buses is 
routed to the Spacehab fire suppression control 
unit (FSCU) and the monitoring and control 
panel (MCP). 


Control and monitoring of the Spacehab EPS is 
provided by hardwired interfaces to the SSP, 
payload multiplexer/ demultiplexer (PL MDM), 
and by discrete inputs and outputs to the DMU. 


Environmental Control Subsystem 


The Spacehab environmental control subsystem 
(ECS) controls the habitable environment and 
provides heat rejection for subsystem and 
experiment thermal control. The ECS provides 
this capability during prelaunch, launch, on 
orbit, entry, and postlanding mission phases. 
The ECS controls atmospheric temperature 
control and pressure limitation, contingency 
depressurization, equipment thermal control, 
smoke detection, fire suppression, experiment 
vacuum venting, atmospheric monitoring, trace 
contaminate removal, and emergency egress 
breathing capability. 


Audio Communication Subsystem 


The audio communication subsystem (ACS) is 
no longer flown on Spacehab missions to the 
ISS. Crew communications from inside 
Spacehab are provided by the battery powered 
speaker microphone unit (BPSMU). Тһе 
BPSMU provides the Spacehab crew with an 
audio communication link to the orbiter/ISS 
and to the flight controllers in the Mission 
Control Center (MCC). 
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The BPSMU has the following audio channels: 
• Air-to-ground 1 (А/С1) 
• Air-to-ground 2 (A/G2) 
• Intercommunication А (ICOM А) 
• Intercommunication В (ICOM В) 
• Раве 
° Alarm tone 


The channels can be configured independently 
to talk/listen, listen only, or off. 


Fire Suppression Subsystem 


The FSS includes both smoke sensors and fire 
suppression equipment. Detection of fire/ 
smoke is annunciated through the orbiter C&W 
electronics unit (CWEU) to crewmembers іп 
both the orbiter and Spacehab module. The fire 
suppression bottles can be discharged using 
controls located on the SSP, on the payload 
safing panel (C3A5), on the Spacehab MCP, or 
by Spacehab SPEC commanding via the orbiter 
DPS display. Fire suppression firing circuits, 
smoke detector data circuits, and test/checkout 
provisions are provided by the FSCU and the 
MCP. 


Activation of the FSS is single fault tolerant 
during all mission phases. А handheld fire 
extinguisher is provided for extinguishing 
localized fires. 


Closed Circuit Television Subsystem 


The closed circuit television (CCTV) cameras or 
orbiter-provided camcorders may be located in 
the Spacehab module for video downlink of 
Spacehab experiment operations. In the 
standard ^ configuration, ^ orbiter-provided 
camcorders are used to provide video recording 
of Spacehab experiment operations. 
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Description 


Various provisions are available for stowing 
loose onboard equipment and trash/waste 
materials during different phases of the flight. 
Provisions consist primarily of rigid and flexible 
containers. 


Rigid containers include: 


e Modular lockers 
e Floor compartments 
e Volume B return trash containers 


The flexible containers are as follows: 


e Flight deck stowage bags 
• Helmet stowage bag 

• Seat FDF containers 

е Soft stowage containers 
e Trash containers 

е Jettison stowage bags 

e In-flight stowage bags 

• Middeck retention net 

e Airlock stowage bags 

e Airlock retention net 


Stowage areas in the orbiter crew compartment 
are located on the flight deck, the middeck, in 
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Rigid Containers 


Modular Lockers 


Some equipment onboard the orbiter is stowed 
in lockers with insertable trays. The trays can 
be adapted to accommodate a wide variety of 
soft goods, loose equipment, and food. The 
lockers are interchangeable and attach to the 
orbiter with spring-loaded captive bolts. The 
lockers can be removed or installed in flight by 
the crewmembers. There are four sizes of trays: 
a single tray (two of which fit inside a locker), a 
double tray, a half-length single tray (four of 
which fit inside a locker), and a half-length 
double tray. Approximately 150 cubic feet of 
stowage space is available, almost 95 percent of 
it on the middeck. 


The lockers are made of lightweight carbon 
fiber composite material much like fiberglass. 
The mounting frame at the rear of the locker 
and locker door are milled aluminum. Guides 
for installation tools and Teflon spacer pads are 
bonded on the composite using epoxy. Lockers 
hold 2 cubic feet of contents that can weigh no 
more than 68 pounds. 


Foam inserts are used in the trays to provide a 
friction fit for zero-g retention. In addition, 
straps, snaps, and mesh retention nets are used 
in some trays. Soft containers are used in 
orbiter spaces too small for the fixed lockers. 


In the aft flight deck, stowage lockers are 
located below the rear payload control panels in 
the center of the deck. A trash container is 
nominally mounted on the port and starboard 
side of the flight deck, near the interdeck access 


ing. Th id tai inter- 
the airlock, and lower equipment bay. dcum A EM а во 
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Middeck Forward Modular Lockers and Floor Compartment 


In the middeck, lockers can be attached to the 
forward avionics bay. Provisions for 33 lockers 
are available in this area. In addition, there is 
an area to the starboard side of the airlock 
module where 11 lockers can be attached. 


To obtain access to the locker interior, the crew- 
member needs to rotate two quarter-turn, self- 
aligning ball latches inboard to release the 
locker door. 


The crewmember can open the door a full 
180°. By using the standard hole pattern of the 
locker, straps and brackets can be attached to 
the locker faces via pip pins for restraining 
equipment. 


In addition, a crewmember can remove lockers 
in flight in order to gain access to the floor 
compartments or the avionics bays. 
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In the event the locker door cannot be closed or 
latched because of misalignment problems, the 
crewmembers can remove the locker and use 
turnbuckles to provide structural support. 


Floor Compartments 


Seven floor compartments are available. Volume 
Е (MD76M) the wet trash compartment, 
provides 8 cubic feet of stowage under the 
middeck floor. The CO» absorbers are 
manifested at MD52M, with the in-use position at 
MD54G. Two other compartments (volumes С 
(MD80R) and H (MD23R)) are used to store 
contingency hygiene equipment and EVA 
accessories respectively. Volume D (MD52C) is 
beneath the forward lockers and holds 
approximately 8 cubic feet. The remaining floor 
compartment, volume E (MD76C), is used 
primarily to store official flight kits and personal 
preference kits. 
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Schematic of Modular Lockers 


Wet Trash Compartment 


To deposit any trash or waste materials into the 
wet trash compartment, the crewmember 
merely lifts the latch handle and opens the 
circular door, deposits the material through a 
rubber grommet into the trash bag, and closes 
the door. Air in the wet trash volume is vented 
overboard at the rate of approximately 
3 Ib/ day. 


NOTE 


The WCS vacuum vent valve must be 
opened to allow the waste gases to be 
vented overboard. 


Тһе types of wet trash to be stowed in the 
compartment are: 


® Medical kit items (no Sharps) 
® Emesis bags 

e Urine collection devices 

e Fecal bags 

e WCS odor/bacteria filter 

e Discarded food packages 
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Volume D (MD52C) 


Partially blocked by middeck forward lockers, 
Volume D is used for EVA Tools, G-suits and 
miscellaneous storage. The door is not hinged. 


The compartment door has a spring-loaded 
latch mechanism. To open, the spring-loaded 
latch mechanism is squeezed between the 
thumb and forefinger to release the latch. Then 
the door is subsequently lifted open. To close, 
the door can be pushed shut without squeezing 
the latch mechanism. 


Volume E (MD76C) 


To gain access to this compartment, two lockers 
(MF71M and МЕ71О) have to be removed. 
Official flight kits and personal preference kits 
are nominally stowed here. The compartment 
door has the same type of spring-loaded latch 
mechanism used in volume D. 


Volume С (MD80R) 


To gain full access to this compartment, lockers 
(MA16L and МА16М) have to be removed. 
Contingency hygiene equipment (urine 
collection devices, diapers, Apollo fecal bags, 
wet wipes, etc.), and a spare odor bacteria filter 
are stowed here. The compartment door has the 


2. SYSTEMS 
2.24 Stowage 


USA007587 
Rev. A 


same type of spring-loaded latch mechanism 
used in volume D. 


Volume H (MD23R) 


This floor compartment has the same type of 
spring-loaded latch mechanism as used in 
volumes E and G. EVA accessories (liquid- 
cooled ventilation garments, EMU batteries and 
lights, tools, etc.) are stowed in this compart- 
ment, located at the base of the interdeck ladder 
on the port side of the middeck. 


Volume A (MF57A) 


This volume installs above the forward lockers 
near the middeck ceiling. With 3 cubic feet of 
stowage, this volume is used as a food pantry. 


Volume B 


This volume is installed just outboard of the aft 
lockers on the starboard side of the middeck. 
To deposit any dry trash, towels, or dirty 
laundry in this compartment, the crewmember 
simply inserts the dry trash material through a 
door located on the inboard side of the 
compartment. 


Volume 3B (МА73)) 


This stowage volume originated as a printer 
closet built into the closeout of the avionics bay 
near the WCS compartment. With the printer 
no longer used, the volume houses a cabin air 
cleaner and emergency breathing masks for 
launch and return. 


Flexible Containers 


Flight Deck Stowage Bag 


For flight deck stowage, a flight deck stowage 
bag is mounted on the back of the CDR and PLT 
seats. Each bag has built-in pockets for stowing 
loose items on orbit. Also called a VW bag, the 
bag must be stowed for launch/return. 


Helmet Stowage Bag 


A Nomex-mesh bag with a drawstring is 
provided for stowing unnecessary FDF material 
or other onboard loose equipment on orbit. The 
bag is located in the CDR's FDF stowage 
container. In addition, one helmet stowage bag 
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is manifested for each crewmember, which is 
used to stow the ACES helmet on orbit. 


The task of inserting desired FDF items into the 
mesh bag consists of simply opening the bag, 
placing items in the bag, and drawing the string 
tight to close. 


Seat FDF Containers 


A soft fabric container, called a saddlebag, is 
available for each seat to store FDF or other 
small loose items. 


Specialist Seat Saddlebag - To remove the 
container from the seat requires the following 
steps: 


e Pull up on container release handle to 
disengage the container attachments 
from seat. 


e Unwrap the container Velcro straps 
from seat leg support structure to 
remove container. 


The specialist seat FDF container is installed on 
the right side as follows: 


e Attach container Velcro straps around 
right side leg support structure. 


e Insert container attachments to seat 
attach point. 


CDR/PLT Seat Saddlebag - These saddlebags 
are Nomex fabric with Velcro closures mounted 
via frame to the panels on the starboard side of 
the CDR and PLT seats. Two bags on each seat 
are used for ascent stowage of CDR and PLT 
FDF as well as helmet bags and headsets. 
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Trash Containers 


Four trash containers are flown. Two 
containers are mounted in the middeck area, 
one on the inside surface of the waste 
management compartment door and one on AV 
bay 3B. The flight deck containers are located 
on the port and starboard flight deck. Each 
container contains a disposable trash bag plastic 
liner, with spares located in the bottom of the 
container (outside the installed liner). 


The crewmember deposits trash into the 
container disposable plastic liner through the 
alligator clamp opening. Once the plastic liner 
is full, the top of the trash bag liner is closed 
with its Velcro closure. The trash bag zipper is 
opened, and the full liner is removed through 
the side opening. The top of the liner can be 
further rolled and secured with gray tape. The 
liner is then stowed in Volume B. A new liner is 
inserted through the trash bag top opening and 
secured to the trash bag mating surfaces using 
the Velcro strips on the liner. 
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Only particular types of trash should be stowed 
in these containers, as follows: 


e Drink containers 


e Wipes used for nonwaste collection 
system purposes 


• Batteries 

e Printer paper 

e Vacuum cleaner residue/bag 

• No wet or odor producing trash 


NOTE 


Absolutely no human waste materials 
(fecal, urine, or emesis) are to be stowed 
in these trash bags/liners. 


The starboard trash bag is flown on panel R15 
on the starboard flight deck. The bag is used to 
hold Photo TV equipment and batteries for 
temporary restraining, stowage, or transporting 
on orbit. 


Jettison Stowage Bags 


Teflon-coated Nomex cloth bags are provided to 
stow equipment and materials on orbit. Each 
bag has a drawstring for sealing the opening of 
the bag. 


At least one of these bags is used as a return-to- 
Houston bag. It contains items (such as 
videocassettes, audio cassettes, film, and notes) 
that must be flown to Houston immediately 
following a mission. 


In-Flight Stowage Bags 


Nomex green or gold colored mesh bags of the 
same approximate dimensions as the jettison 
stowage bags are stowed in a middeck stowage 
locker. The bags are used for stowing the 
crewmembers' launch equipment such as ACES, 
boots, and harness. Each bag has a drawstring 
to seal the opening of the bag. 
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Middeck Retention Net 


The middeck retention net, a polybenzine imi- 
dazole brown-colored mesh net with caribiners, 
is manifested on non-sleepstation flights. This 
net is used to restrain items such as seats, 
launch/entry suits, boots, and helmets on orbit. 
It is located on the starboard forward middeck 
and attaches to the MF71 row of lockers and the 
starboard wall. 


Middeck Stowage Bag 


Made of white Nomex, these bags come in 5 
MLE (middeck locker equivalent) and 10 MLE 
sizes and are used for generic stowage and 
transfer. For launch and return, these bags are 
secured via Kevlar straps to composite pallets 
that are bolted to the middeck aft area. 


Airlock Stowage Bag 


The airlock stowage bag, when manifested, is 
mounted to the external airlock floor. This bag 
is made of white Nomex material and provides 
an alternate stowage location, primarily for 
SAFER. 


Tunnel Retention Net 


The tunnel retention net is used to restrain 
equipment in the Spacehab tunnel. It is a brown 
polybenzine imidazole mesh net that covers the 
EVA hatch and is used only for on-orbit 
stowage. 
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Middeck Accommodations Rack 


The middeck accommodations rack (MAR) 
permits stowage of small payloads and 
experiments in the middeck of the orbiter. The 
MAR is installed just forward of the side hatch 
in the area aft of the galley. The MAR provides 
approximately 15 cubic feet of internal volume 
with a maximum payload weight of about 340 
pounds. 


The lightweight middeck accommodations rack 
(LWMAR) is usually flown in place of the MAR 
in the absence of a powered payload. Тһе 
LWMAR is a carbon-fiber composite structure 
which offers approximately the same stowage 
volume as the MAR, but at a much lighter 
weight and can hold a maximum weight of 
about 390 pounds. 


The LWMAR has two bi-fold doors that swing 
upward and downward to provide access to the 
shelves inside. Each door is held in place with 
eight latches. These doors are opened half at a 
time by retracting four latches. Internal shelves, 
also made of composite carbon fiber material, 
are bolted in place and can be relocated, 
reconfigured or removed by ground personnel 
to satisfy mission stowage requirements. 


2.24-6 


Bi-fold Doors 


Lightweight MAR Assy 
(LWMAR) 


USA007587 
Rev. A 


MAR Cushion, 
CCTV Camera 


MAR Cushion, 
PGSC/Accessories 


MAR CTB, 
Color Printer. 


MAR CTB, 
Vacuum Cleaner 


MAR Cushion, 
B/U CCTV Camera 


(typical) 


Lightweight Middeck Accommodations Rack (LWMAR) 
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225 WASTE MANAGEMENT 


SYSTEM (WMS) 


CONTENTS 


Description 
Operations 


Description 


The waste management system (WMS) is an 
integrated, multifunctional system used 
primarily to collect and process crew biological 
wastes. The WMS is located in the middeck of 
the orbiter crew compartment in a 29-inch-wide 
area immediately aft of the crew ingress and 
egress side hatch. 


The system collects, stores, and dries fecal 
wastes. It processes urine and transfers it to the 
wastewater tank and processes EMU 
condensate water from the airlock and transfers 
it to the wastewater tank if an EVA is required 
on a mission. The system also provides an 
interface for venting trash container gases 
overboard and dumping atmospheric 
revitalization wastewater overboard in a 
contingency situation, and it transfers 
atmospheric revitalization system wastewater 
to the wastewater tank. 


A waste management compartment door and 
two privacy curtains attached to the inside of 
the door provide privacy. One curtain is 
attached to the top of the door and interfaces 
with the edge of the interdeck access, and the 
other is attached to the outer edge of the door 
and interfaces with the middeck 
accommodations rack (MAR), if installed. The 
door also serves as an ingress platform during 
prelaunch (vertical) operations since the flight 
crew must enter the flight deck over the waste 
management compartment. The door has a 
friction hinge and must be open to gain access 
to the waste management compartment. 


The WMS consists of a commode, urinal, fan 
separators, odor/bacteria filter, vacuum vent 
quick disconnect, and controls. The commode 
is 27 by 27 by 29 inches, and it is used like a 
standard toilet. The commode contains a single 
multilayer hydrophobic porous bag liner for 
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collecting and storing solid waste. When the 
commode is in use, it is pressurized, and 
transport air flow is provided by the fan 
separator. When the commode is not in use, it 
is depressurized for solid waste drying and 
deactivation. 


Crewmember 
Biowastes 
Extravehicular | үзээ 
L 
Mobility Unity Lud Gas | Wet Trash 
Airlock 
115 Volts ac 
28 Volts dc} Electrical 
Power 
System 
Waste 
Cabin Air —® Collection |» Cleaned 
System Air 


| 


Wastewater 

Storage Tank 
and Overboard Vacuum Vent 
Dump System System 
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Waste Management System 


The urinal is essentially a funnel attached to a 
hose and provides the capability to collect and 
transport liquid waste to the wastewater tank. 
The fan separator provides transport air flow 
for the liquid. The fan separators separate the 
waste liquid from the air flow. The liquid is 
drawn off to the wastewater tank, and the air 
returns to the crew cabin through the 
odor/bacteria filter. The filter removes odors 
and bacteria from the air that returns to the 
cabin. The vacuum vent quick disconnect is 
used to vent gases directly overboard from 
equipment connected to the quick disconnect 
through the vacuum line. 


The urinal assembly is a flexible hose with 
attachable funnels that can accommodate both 
men and women. The assembly can be used in 
a standing position. 
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All waste management system gases are air. The filter can be removed for in-flight 
ducted from the fan separator into the replacement. 


odor/ bacteria filter and then mixed with cabin 


Various restraints and adjustments enable the 
crew to achieve the proper body positioning 
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to urinate or defecate in a zero-gravity 
environment. Two foot restraints are 
provided. A toe bar is located at the 
commode base and is used for standing 
urination. It consists of two flexible 
cylindrical pads on a shaft that can be 
adjusted to various heights by releasing two 
locking levers that are turned 90° 
counterclockwise. The crewmember 15 
restrained by slipping his or her feet under 
the toe bar restraint. 

Rotating fluid 

reservoir 


Commode 
air inlet 


odor/ 
bacterial 
^ filter 


Water/urine = 
to waste я 
water tank Pitot tube 
Fluid output == ..... Water/urine/air 
connector —— Commode air 
= Water/urine 
777 Air 
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Waste Management System Fan Separator 


А footrest restrains the feet of a crewmember 
sitting on the commode. The footrest consists 
of an adjustable platform with detachable 
Velcro straps for securing the feet. The Velcro 
straps are wrapped crosswise over each foot 
and secured around the back. The footrest 
can be adjusted to various angles and heights. 
Two locking handles pulled outward adjust 
the angle; two other locking levers adjust the 
height of the footrest. 


Two body restraints are provided for when 
crewmembers are seated on the commode. 
This restraint is a thigh bar that the 
crewmember lifts up out of the detent 
position, rotates over the thigh, and releases. 
The thigh bar exerts a preloaded force of 
approximately 10 pounds on each thigh. 


Handholds are used for positioning or 
stabilizing the crewmember and form an 
integral part of the top cover of the waste 
management collection system assembly. 
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The WMS compartment is stocked with 
gloves, trash bags, tissues, and wet wipes. 
Rubber grommets in the compartment allow 
crewmembers to restrain their towels and 
washcloths. 


Seat 


Commode 


Slide valve 


Liner 


Container 
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Waste Management System - Middeck 
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Operations 


The controls on the waste collection system 
(WCS) are the VACUUM VALVE, FAN SEP 
select switch, MODE switch, fan separator 
bypass switches, and COMMODE CONTROL 
handle. The system uses dc power to control 
the fan separators and ac power for fan 
separator operations. The MODE switch and 
the COMMODE CONTROL handle аге 
mechanically interlocked to prevent undesirable 
system configurations. The remaining controls 
operate independently. The fan separator 
bypass switches allow the crewmember to 
manually override a fan separator limit switch 
failure. 


For launch and entry, the VACUUM VALVE 
switch is set to CLOSE. During on-orbit 
operations, when the WCS is not in use, the 
vacuum valve is set to OPEN. This exposes the 
commode overboard via the vacuum vent 
system, and any solid wastes in the commode 


| 
COMMODE/ ө 
MANUAL/ EMU 


N p= жа ON 
ОБЕ We =” оғғ 
SEP2 SEP1 
BYPASS 

<> 


\ 
ВҮРА55 CLOSE OPEN 
VACUUM VALVE 


are dried. This also allows venting of the 
auxiliary wet trash and the volume F wet trash 
compartment. The hydrophobic bag liner in the 
commode allows gas from the commode to vent 
overboard, but does not allow the passage of 
free liquid. 


In the urine collection mode, the VACUUM 
VALVE remains in OPEN. The FAN SEP 
switch is positioned to 1 or 2. When the switch 
is positioned to 1, main bus A dc power is 
supplied to fan separator 1; when it is 
positioned to 2, main bus B dc power is 
supplied to fan separator 2. The MODE switch 
positioned to AUTO energizes a microswitch in 
the Auto cradle for the selected fan separator 
(dependent on FAN SEP position). When the 
urinal hose is removed from the cradle, the 
active fan separator pulls cabin air flow through 
the urinal at a minimum of 10 cubic feet per 
minute and cabin air through the coffee can at 
30 cubic feet per minute. 


m COMMODE CONTROL Lc 


PRIOR TO DEFECATION 
1, PULL UP 

2. WAIT 15 SEC 
3.44- PUSH FWD 
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Waste Management System Controls 
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The coffee can air mixes with the urine 
transport air flow in the fan separator. Liquid 
check valves at the wastewater outlet from each 
fan separator prevent backflow through the 
non-operating separator during separator 
operation and prevent backflow to the urinal 
and air outlet when the separators are off. The 
liquid and air mixture from the urinal line 
enters the fan separator axially and is carried to 
a rotating chamber. The mixture first contacts a 
rotating impact separator that throws the liquid 
to the outer walls of the rotating fluid reservoir. 
This centrifugal force causes the liquid to 
separate and draws it into a stationary pitot 
tube in a reservoir and directs the liquid 
through the dual check valves and into the 
wastewater tank. Air is drawn out of the 
rotating chamber and passes through the 
odor/bacteria filter, where it mixes with cabin 
air and re-enters the crew cabin. 


In the EMU water drain mode, a guard is 
rotated over the MODE switch to preclude 
deactivation during the EMU and airlock water 
collection mode. The urinal cannot be used 
during the EMU dump because of possible 
separator flooding. EMU condensate water is 
drained only if an EVA is required on a mission. 
The EMU wastewater is dumped through 
wastewater valves in the airlock. Other than 
these requirements, EMU dump is the same as 
the urine collection mode. 


In the urine and feces collection mode, the 
MODE switch і moved to Ње 
COMMODE/MANUAL/EMU position, Ње 
COMMODE CONTROL handle is pulled up, 
and the commode is pressurized with cabin air 
through the debris screen and flow restrictor in 
approximately 15 seconds. 


NOTE 


If the MODE switch is positioned to 
AUTO, the handle cannot be pulled up 
because of a mechanical interlock. At the 
top of the handle is a pop off ball that will 
come off at 40 Ib of force to prevent 
damage to the linkages inside the unit. 


The COMMODE CONTROL handle 15 
positioned to PUSH FWD after 15 seconds (it 
cannot be pushed forward until after 15 seconds 
because of the delta pressure across the slide 
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valve, and it cannot be pushed forward unless 
the MODE switch is positioned all the way to 
the | COMMODE/MANUAL/EMU position). 
When the COMMODE CONTROL handle is 
pushed forward, the slide valve on the 
commode is opened. 


The WCS is used like a normal toilet. The 
commode seat is made of a contoured, hard 
Ultem plastic material that provides proper 
positioning and is sealed to minimize air 
leakage. Feces enter the commode through the 
4-inch-diameter seat opening and are drawn in 
by cabin air flowing through holes under the 
seat at 30 cubic feet per minute. Fecal matter is 
deposited into the porous bag liner, and the air 
is drawn through the hydrophobic material to 
the fan separator. The hydrophobic liner 
material prevents free liquid and bacteria from 
leaving the collector. All paper is deposited in a 
WCS canister bag and then placed in the WCS 
auxiliary wet trash compartment. It is 
recommended that no tissues be placed in the 
commode, since they tend to block airflow and 
cause more bulk in the commode. Urine is 
processed as in the urine collection mode. The 
BACK/DOWN position of the COMMODE 
CONTROL handle closes the slide valve and 
depressurizes the commode for deactivation 
and solid waste drying. If the handle were left 
partially up, it would cause loss of cabin air 
through the vacuum vent. 


NOTE 


The COMMODE CONTROL handle must 
be completely down (in BACK/DOWN 
position) upon completion of WMS usage, 
or loss of cabin air through the vacuum 
vent valve will occur. 


After usage, the WCS should be cleaned with 
wet wipes to maintain an odorless and sanitary 
environment. Тһе seat can be lifted for 
cleaning. The WCS should be sanitized once a 
day with a disinfectant wipe. Urinal funnels may 
be sanitized daily with the disinfectant wipe as well. 


Alternate Fan Separator Operations 


If fan separator 1 is inoperative or fails to 
achieve proper operational speed (which can be 
verified by a reduced noise level or lack of air 
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flow), the FAN SEP switch is positioned from 1 
to 2, and hose block from 1 to 2, then operate as 
normal. 


The lever-locked FAN SEP 1 BYPASS and FAN 
SEP 2 BYPASS switches permit the crew to 
manually override a fan separator limit switch 
failure in either the FAN SEP or MODE 
switches. When either switch is positioned to 
ON, ас power is applied to the corresponding 
relay, energizing it and providing ac power to 
activate the corresponding fan separator. Both 
BYPASS switches should not be ON at the same 
time. Before the SEP 1 or 2 BYPASS switch is 
activated, the FAN SEP select switch and hose 
block should be positioned in the corresponding 
fan separator position to preset the fan 
separator inlet valve. 


Vacuum Vent System 


The vacuum vent system provides a pathway 
for removal of hydrogen (off-gassed by the fuel 
cells), for venting odors, and for drying solid 
waste material in the commode when the 
commode is not in use. 


The vacuum vent line T's off from the WCS line 
at the WCS three-way ball valve. When the 
commode is not in use, it is exposed to vacuum 
through this vent line. A manual valve that is 
downstream of the commode serves to isolate 
the WCS from the vacuum vent system, if 
required. One situation in particular where this 
would be necessary would be if the WCS failed 
and created a cabin leak. The vacuum vent 
isolation valve is located downstream of the 
vacuum valve. It is controlled by the WASTE 
НО VACUUM VENT ISOL УГУ CONTROL 
switch on panel ML31C. This switch receives 
electrical power from the VACUUM VENT 
ISOL VLV BUS SELECT switch on panel ML31C 
when the switch is positioned to ММА ог 
MNB. 


When the WASTE ЊО VACUUM VENT ISOL 
VLV CONTROL switch is positioned to OPEN, 
the vacuum vent isolation valve is opened, 
allowing the vacuum vent line to be open to 
vacuum. A talkback indicator above the switch 
indicates OP when the valve is open, barberpole 
when the valve is in transit, and CL when the 
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valve is closed. The unpowered position closes 
the valve. 


Even if the vacuum vent isolation valve could 
not be opened, vacuum vent functions would 
not be lost. A small hole in the valve plate 
allows proper venting overboard in such a 
contingency. 


Alternate Vacuum Venting 


Between the WCS ball valve and the vacuum 
vent valve is a vacuum vent quick disconnect 
(QD). For a failure of the vacuum vent system, 
vacuum venting can be regained by connecting 
a transfer hose from this QD to the contingency 
wastewater crossite QD, which allows venting 
through the wastewater dump line. 


Heaters 


Thermostatically controlled heaters are installed 
on the vacuum vent line. Electrical power for 
the A and B heaters is supplied on the НО LINE 
HTR A and B circuit breakers on panel ML86B. 
(These circuit breakers also supply electrical 
power to supply water dump line A and B 
heaters and wastewater line A and B heaters.) 


Heaters are also installed on the vacuum vent 
nozzle and are controlled by the WASTE НО 
VACUUM VENT NOZ НТК switch on panel 
ML31C. Electrical power is supplied to the 
vacuum vent nozzle heaters when the switch is 
positioned to ON. The OFF position removes 
electrical power from the vacuum vent nozzle 
heaters. 


Alternative Waste Collection 


For a non-operational WCS, contingency waste 
collection devices are available. Fecal collection 
is accomplished by using an Apollo fecal bag. 
Apollo fecal bags can be stowed inside the WCS 
commode or in the wet trash (volume F) 
compartment. For men, the urine collection 
device (UCD) is used for urine collection. A 
UCD consists of a collection bag, a restraint 
assembly, and a roll-on cuff. For women, urine 
collection is accomplished via absorbent pants 
(Pull-Ups). The Pull-ups are a modified version 
of adult diapers. 
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3. FLIGHT DATA FILE 


CONTENTS 


CONTROL DOCUMENTS 
SUPPORT DOCUMENTS 
OFF-NOMINAL 
DOCUMENTS 

REFERENCE DOCUMENTS... 
OPERATIONAL USE 


The Flight Data File (FDF) is the total onboard 
complement of documentation and related crew 
aids available to the crew for flight execution. 
The FDF consists of procedural checklists, 
timelines, schematics, charts, cue cards, portable 
onboard computer software,  teleprinter/ 
graphics messages, and accessories. The FDF 
also includes office-type supplies, such as pens, 
pencils, markers, Velcro, and rubber bands. 
The FDF used in training is essentially identical 
to the material used on orbit, except where 
trainer-unique characteristics require 
differences. 


The Crew Procedures Control Board (CPCB) is 
the governing body for establishing guidelines 
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and policies pertaining to the development, 
publication, fabrication, and validation of FDF 
under the authority of the Director of Mission 
Operations. The management process, policies, 
and guidelines under which the FDF is 
developed are contained in the Crew 
Procedures Management Plan (CPMP), 
USA-005466. This plan and its Annexes A-E 
detail the development of crew procedures and 
activities as well as the fabrication and 
processing of the FDF material. Crew 
procedures and activities are documented in a 
variety of books and checklists. Time-critical or 
frequently used procedures are documented on 
cue cards and in flip books (a series of cue cards 
that are ringed together). These documents are 
categorized into four groups: 


Control documents — The FDF books that 
provide the schedule of crew activities for 
an entire flight. There is one controlling 
document for every phase of a flight 
(i.e., Ascent, Post Insertion, Orbit, Deorbit, 
and Entry). These documents are time 
oriented and refer to other FDF documents 
as required. 


FDF Products 
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e Support documents — Used on orbit to 
accomplish various objectives scheduled 
in the Control documents, such as flight- 
specific payload procedures, EVA, or 
rendezvous and proximity operations. 
The CPCB may occasionally designate a 
Support book as the controlling document 
for that specific phase of the flight. 


e Off-Nominal documents — Contain 
contingency procedures for all phases of 
flight. 


e Reference documents — Provide data 
not normally required for a particular 
task, but useful to the crew. Documents 
include DPS displays, caution and 
warning (C/W) parameters, landing site 
charts, and stowage locations for crew 
use items. 


Each FDF book within the four main groups 
can also be categorized into one of three 
subgroups: 


• Generic documents — Reflown from 
flight to flight since they usually do not 
contain flight-specific data. Temporary 
pages may occasionally be added to 
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Generic documents to account for vehicle 
or mission-specific data. 


e  Flight-Specific documents — Contain 
flight-specific data used in conjunction 
with Generic publications. Flight- 
specific documents contain data for a 
single mission and have no generic 
companion document. 


e Standby Supplements — Contain 
procedures that are not flown because 
they have a very low probability of being 
needed. The data are available on 
console in Mission Control and can be 
uplinked if required. 


Certain pages of Control, Support, and Off- 
Nominal documents are labeled “Not Flown.” 
These pages are included in the books sent to 
the various recipients on the distribution list, 
including Mission Control, but are not 
included in the “flight quality” copies used in 
the trainers or in flight. Cue cards are also 
included in the body of the distribution 
copies but may not be flown as part of a book 
or checklist; exceptions are Ascent and Entry 
Cue Cards and flip book pages that are 
provided to mission specialist 2. 


ОО = GENERIC (ALL FLIGHTS) BOOK «= BASELINE (GENERIC) DOCUMENT. 
ы = FLIGHT-SPECIFIC BOOK OR SUPPLEMENT SU conn pate seid 
= CONTAINS SPECIAL PAGES FOR DOCUMENT FLOW FORALL MISSIONS 
MISSION SPECIALIST — =MISSION-DEPENDENT FLOW 
(CUE) = = NOMINALLY SUPPORTED BY CUE CARDS, 
Р BOOKS AND/OR OVERLAYS = ELECTRONIC DOCUMENT ONLY 


CONTROL 
DOCUMENTS 


SUPPORT 
DOCUMENTS 


OFF-NOMINAL 
DOCUMENTS 


SSP FDF Structure (Typical Books) 
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(D One section of the Ref book is flown in both the Asc СЛ. 
and the Ent C/L 


(©) Book is not flown. Documents configuration of crews 


systems cards and items requiring special 
construction. 


(8) Baselined for each specific 
(PAM Deploy, IUS Deploy, etc.). 


(8) One book contains both off-nominal procedures 
and reference information. 


© The Maps book is not flown as published. The Landing 
Site Charts book and various loose items, such as star 
maps and world atlas, are flown separately. 


(8) The Pwr Dn book is published as a separate document 
but divided between the Asc Pkt C/L, Orb Pkt C/L, and 
Ent Pkt C/L for flight use. The A/E Sys book is 
published as a separate document but divided between 
the Asc Pkt C/L and Ent Pkt C/L for flight use. 


Ф The Mal book is published аз one book but flown іп two. 
binders (volumes). The document is also flown in 
electronic format. 
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CONTENTS 


Flight Plan 
Deorbit Preparation Book 
Entry Checklist 


Ascent Checklist 


The Ascent Checklist is а flight-specific 
document. This checklist contains the nominal 
procedures for prelaunch through the post- 
OMS 2 burn, aborts, weather preliminary 
advisory data (PADs), and prelaunch switch 
configurations (not flown). Abort entry related 
material is included in this checklist because of 
the time critical nature of ascent aborts. Ascent 
Cue Cards are also controlled by the Ascent 
Checklist. 


FRONT | BACK 
• RTLS Contingenc 
e OPS 1 RCS burn 
• OMS burn monitor 
• ADI err/rate switch (ENT 


| 
| 
е Entry alpha x 
е Ascent ADI-nominal 
• AOA deorbit burn (2 engine) * X 
е AOA deorbit burn (1 engine) * 
• AOA deorbit burn (RCSO 2 
* (XXX) TAL redesignation X 
® (XXX) TAL redesignation 
e (XXX) TAL redesignation 
» Ascent/abort summar 
X 
X 


Emergency Egress 
Escape Panel Egress 
GPC/FCS Channel config 
Panel R14 

LOC Breakup 


* Hinged Card 


| 
| 
или 
[:* 
Ez 


1 
2 
3 
4 
5 
7 
10 
11 
12 


X 
X 


Ascent Cue Card 


There are five Ascent and Entry Flip Books that 
are controlled by the Ascent/Entry Systems 
Procedures Book in the Off-Nominal group of 
FDF. 
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Post Insertion Book 


The Post Insertion Book is a flight-specific 
document that includes summary and detailed 
timelines and procedures to prepare the orbiter, 
crew, and payload for on-orbit operations. 
Additionally, it contains on-orbit switch 
pictorials and abort to orbit (ATO) post 
insertion data. There are no Post Insertion Cue 
Cards; however, during the post insertion 
phase, cue cards for various on-orbit activities 
are unstowed and utilized. 


Flight Plan 


The Flight Plan is a flight-specific book that 
contains summary timelines for the orbiter 
(launch through landing) and payloads. It also 
contains the detailed nominal and contingency 
timelines for the overall mission, including key 
ground support, crew, orbiter, and payload 
systems operations. The Flight Plan may also 
contain the Attitude Timeline if the number of 
attitude changes warrants its inclusion. There 
are no Flight Plan cue cards. The Flight Plan is 
the controlling document for the Digital 
Autopilot (DAP) Book, which is stowed in one 
of the pilot's FDF lockers. 


Deorbit Preparation Book 


The Deorbit Preparation Book (Deorbit Prep) 
contains a summary and detailed timeline for 
nominal deorbit preparation procedures that 
begin about 4 hours prior to the deorbit burn. 
The book also contains contingency 
modifications to these procedures and the steps 
to back out of deorbit preparation should a 
waveoff be required. Additionally, this book 
contains a pictorial of the entry switch list, 
nominal and contingency deorbit preparation 
procedures for payload bay door closure, and 
backup flight system (BFS) deorbit preparation 
notes. There are no cue cards controlled by the 
Deorbit Prep book. 
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Entry Checklist 
The Entry Checklist (Generic and Flight 


Supplement) becomes the controlling document 
about 43 minutes prior to the deorbit burn. This 
checklist contains pre-deorbit burn, post-burn, 
entry, and post-landing procedures. Entry Cue 
Cards are also controlled by the Entry Checklist. 
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CARD | CARD 
iu BACK 


® Deorbit burn monitor 
e OMS failures 
е Deorbit burn (2 engine) 
® Deorbit burn (1 engine) 
е Deorbit burn (mixed xfeed) 
5 
| 6 |» Entrycontrol || 
7 |» Entry maneuvers (El-5 - V=10K) 
e Entry maneuvers (V=7K - STOP)/ 
Orbiter Xwind limits 
e Entry no/go checklist 
» ADTA mgmt; no comm TACAN mgmt; nav 
delta pad; bailout mode 8; postlanding 
mode 5 


|9 |, Масмарћа || 
|__-_______________________ 


* Hinged Card 


1 | Deorbit burn flight rules 
• One orbit late available 
е RTLS Contingenc 
[5 | 


Entry Cue Cards 
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3.2 SUPPORT DOCUMENTS 


CONTENTS 


Orbit Operations Checklist 

Photo/TV Checklist 

Payload Deployment and Retrieval 
System Operations Checklist... 


Extravehicular Activity Checklists .... 
Rendezvous Checklist 


Payload Operations Checklist 
Deploy Checklist 
Additional Support Documents 


The generic documents and flight supplements 
within this group are bound together for 
training and flight rather than integrated. 


Orbit Operations Checklist 


The Orbit Operations (Orbit Ops) Checklist 
contains the procedures for on-orbit operation 
of orbiter systems, pre-sleep апа postsleep 
periods, detailed test objectives (DTOs), and 
separation maneuvers. Cue cards are controlled 
by the Orbit Ops Checklist, which provide 
procedures for saving data in the modular 
memory units (MMUs), a directory of general 
purpose computer (GPC) specialist function 
(SPEC) and display (DISP) assignments, and 
procedures for fuel cell purging. 


Photo/TV Checklist 


The Photo/TV Checklist contains the procedures 
for still, motion picture, and closed circuit 
television (CCTV) camera configuration 
(including camcorder). It also contains camera 
setup, activation, and deactivation procedures for 
photo/TV scenes, camera displays and controls, 
and camera malfunctions. Photo/TV Cue Cards 
detail nominal procedures for the use of the 
CCTV system, video tape recorder (VIR), ЕТ 
photography and film use. (Examples of cue 
cards are in Section 2.3.) 


Payload Deployment and Retrieval 
System Operations Checklist 


The Payload Deployment and Retrieval System 
(PDRS) Operations Checklist Generic and Flight 
Supplement documents fly only on shuttle 
missions that have the remote manipulator 
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system (RMS) manifested. These documents 
contain the RMS and RMS/payload nominal, 
backup, and contingency procedures. They also 
contain CCTV data for the RMS television 
cameras (along with the Photo/TV Checklist) 
and RMS-related EVA procedures. The PDRS 
document controls two standard cue cards. 
Their purpose is to quickly safe the payload, 
orbiter, or RMS from failures that affect end 
effector operations and, if possible, to complete 
successfully the mission deploy or retrieval 
objective. 


Extravehicular Activity Checklists 


The Extravehicular Activity (EVA) Generic and 
Flight Supplement Checklists are flown for 
planned EVAs or for payloads that have EVA 
backup procedures. These checklists contain all 
the procedures for EVA preparation through 
post-EVA. Also included are extravehicular 
mobility unit (EMU) maintenance, recharging, 
and malfunction procedures, plus EMU 
contingency data and airlock nominal and 
emergency procedures. Two cue cards are 
controlled through the EVA Checklist. They 
contain procedures for orbiter airlock 
depressurization/repressurization and EMU 
leak check data. The EVA Checklist also 
controls the EVA cuff checklist worn on the 
EMU sleeve. 


Rendezvous Checklist 


A Rendezvous (RNDZ) Checklist is flown for 
missions involving a planned rendezvous and 
for flights that involve an RMS deploy with a 
planned contingency rendezvous revisit. This 
checklist contains a rendezvous flight profile 
diagram, a flight rules summary, a deploy 
timeline (if appropriate), a rendezvous timeline, 
contingency operations, rendezvous OMS burn 
procedures, and reference data regarding the 
DAP, relative motion, targeting, and operation 
of onboard piloting tools. For missions to the 
ISS, the Androgynous Peripheral Docking 
System (APDS) nominal procedures, оН- 
nominal procedures, and docking sequence cue 
card are included. The Rendezvous Checklist 
also controls several cue cards: RCS burn, 
RNDZ propellant PAD, Proximity Operations 
Procedures, Ku Radar Rendezvous Operations, 
Nominal Radar Angles & Camera Angles 
Ranging Chart, and an RMS End Effector 
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Camera Overlay (for aid in flyaround of the 
free-flying payload.) 


During the rendezvous phase of а flight 
(typically the three orbits immediately before 
and including) grapple or docking, the 
Rendezvous Checklist is the primary 
controlling document. For use during RMS 
deploys, the Rendezvous Checklist contains the 
deploy timeline, which includes references to 
the PDRS Checklist. 


Payload Operations Checklist 


The Payload Operations (PL OPS) Checklist is a 
flight-specific document that contains payload 
systems procedures for on-orbit operations 
through deorbit preparation. There may be 
mission/payload-specific cue cards associated 
with this book. For complex payload missions, 
a Payload Systems Data and Malfunction (PL 
SYS) Book may be flown. This book contains 
payload-specific malfunction procedures, 
reference information, and payload drawings 
requested by the crew. 


CDR flip 
card back — 


Deploy Checklist 


The Deploy Checklist is also a flight-specific 
book with the payload identified in the title. 
This document covers all phases of deploy from 
payload checkout through deploy (including 
RMS procedures) апа orbiter separation 
activities. The checklist also contains deploy 
flight rules, backup, contingency, and jettison 
procedures, forward RCS data, and payload- 
critical action responses. The number and types 
of Deploy cue cards flown are payload specific. 


Additional Support Documents 


There may be additional support documents 
and associated cue cards flown to support 
unique mission requirements. The Cue Cards 
and Procedural Decals Book is published and 
distributed for ground use. It does not fly on 
the orbiter. It is the controlling document for 
decals and cue cards that do not reside in other 
publications. ^ Additionally, this document 
dictates guidelines and constraints for the 
fabrication of all cue cards and CCTV overlays 
and provides diagrams for the placement of 
flight deck cue cards for various mission 
phases. 


Г. OVHD flip book 


CDR ascent flip book 
Ascent ADI | Y 00 
МАСН/а a 


PLT flip card back 


ADI error/rate switch FL 


CDR window Qs 


flip book 


PLT window flip book 


ADI error/rate switch 


Ascent/entry SPEC 


Fire/smoke 


Speed brake 


и Trim/OSC 
OMS burn monitor 
OMS 2/orbit OMS burn 


ASC/RTLS/TAL restring 
ET SEP 


ve 


OMS burn monitor 
OMS 2/orbit OMS 
burn CG calculator 
(PLT only) 


Cue Cards 


GPC/FCS 


Not shown: Escape PNL egress (back of CDR seat) 
Mode 1 and 5 egress (back of PLT seat and on middeck) 
Teleprinter (above L9 if flown) 


Contingency Abort 


798.cvs 


Flight Deck Ascent Cue Card Placement 
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3.3 OFF-NOMINAL DOCUMENTS 


CONTENTS 


Systems Abort Once Around Book... 3.3-1 


Malfunction Procedures Book 


In-Flight Maintenance Checklist 
Payload Systems Data and 
Malfunction Procedures Book. 


Pocket Checklists 


Some of the documents in the Off-Nominal 
section of the FDF contain critical procedures that 
must be performed within 5 minutes. The three 
pocket checklists (PCLs) (Ascent, Orbit, and 
Entry) and associated cue cards contain these 
critical data. The PCLs are readily distinguished 
by the yellow card stock used for the pages. The 
Ascent PCL contains procedures that safe 
systems for continued flight. It also contains 
orbiter systems powerdown procedures. 


At the initiation of the post insertion phase, the 
Orbit PCL is utilized. This PCL contains critical 
orbiter systems malfunction responses and 
powerdown procedures. The orbit PCL often 
refers to the orbiter Malfunction Procedures 
(MAL) Book for detailed troubleshooting. 


The Entry PCL contains critical contingency 
systems malfunction responses that allow safe 
continuation of the pre-deorbit through early 
entry phases along with orbiter systems 
powerdown procedures. 


Ascent/Entry Systems Procedures Book 


The Ascent/Entry Systems Procedures Book 
does not fly as a standalone document. It is the 
control source for the CDR and PLT Ascent/ 
Entry Flip Books and Cue Cards. The first nine 
sections of this document are replications of all 
the Ascent/Entry Flip Books (excluding Ascent 
Flip Books) and Cue Cards. They are added to 
the front of the MS2’s Ascent PCL and again to 
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the Entry PCL (minus the ascent-specific pages) 
to assist MS2 in supporting the CDR/PLT 
during these critical phases of flight. These 
pages are printed on white stock to differentiate 
them from the PCL data. 


Systems Abort Once Around Book 


The Systems Abort Once Around (SYS AOA) 
Book contains time-critical steps for the loss of 
two Freon or water loops precipitating an AOA. 
Initial steps for the loss of Freon loops or water 
loops are in the CDR’s Flip Book and in the 
front of the MS2’s Ascent PCL. This document 
also contains deorbit burn monitor procedures, 
post-burn actions, entry maneuver procedures, 
and panel configurations. 


Malfunction Procedures Book 


The MAL Book is a large document dealing 
with diagnostic steps used to identify, isolate, 
and correct orbiter systems malfunctions 
subsequent to quick response procedures or 
noncritical system problems. Бог orbiter 
malfunctions not covered in the Orbit PCL, the 
MAL Book is the prime reference. The 
procedures in the MAL Book are applicable for 
on-orbit operations only. They may be flown 
electronically or in hardcopy. 


In-Flight Maintenance Checklist 


The In-Flight Maintenance (IFM) Checklist 
contains repair/reconfiguration procedures for 
critical systems, and layouts of orbiter system 
components. There is also a Standby Supple- 
ment available in Mission Control that contains 
additional procedures. 


Payload Systems Data and Malfunction 
Procedures Book 


The Payload Systems Data and Malfunction 
Procedures (PL SYS DATA) Book is a flight- 
specific document that contains both off- 
nominal procedures and reference information 
for the mission’s payloads; it includes DPS 
displays, systems schematics, malfunction 
diagnostic flow, critical equipment lost with 
multiplexer/ demultiplexer (MDM) failures, and 
photographs of payloads in the PLB. 


3. FLIGHT DATA FILE 


3.3 Off-Nominal Documents 


USA007587 
Rev. A 


Medical Checklist 


The Medical (MED) Checklist Generic contains 
emergency medical procedures, medical 
techniques with illustrations, and equipment/ 
medicine stowage. There are two cue cards 
associated with the MED Checklist. They are 
the MEDICATION DATA LOG, which is used 
to track medication usage from the Shuttle 
Orbiter Medical System (SOMS) ага the 
AIRWAY “ILMA” (Intubating Laryngeal Mask 
Airway) cue card. The ILMA cue card provides 
procedures on how to establish an open airway 
on an incapacitated crewmember. 
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Contingency Deorbit Preparation Book 


The Contingency Deorbit Preparation (CONT 
Deorbit PREP) Book contains procedures and 
the switch list for emergency deorbit during 
orbits 2 or 3. It also contains the deorbit 
procedures used for loss of the flash evaporator, 
two fuel cells, two water loops, or two Freon 
loops. Although this document has no cue 
cards, landing site charts and other appropriate 
data are added to flight copies for crew 
convenience. 
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34 REFERENCE DOCUMENTS 
CONTENTS 
Reference Data Book 


Systems Data Book 
Data Processing System 


Dictionary 
Payload Systems Data/ 

Malfunction Book 
Maps and Charts Book 


Reference Data Book 


The Reference Data (REF DATA) Book contains 
lists of critical inoperative equipment with the 
loss of a bus or subbus and an ac/dc power 
outlet chart. There are also lists of 
input/output (I/O) GPC parameters lost when 
selective MDMs are inoperative. Additionally, 
there is a list of all fault messages, C/W and 
fault detection and annunciation (FDA) tables, 
and a complete stowage list for crew 
equipment, clothing, and Flight Data File (FDF). 
User notes that were formerly a part of the DPS 
Dictionary have also been added. 


Systems Data Book 


The Systems Data Book (SYS DATA) is a large 
document containing selected schematics of 
most orbiter systems and structures taken 
directly {тот the Space Shuttle Systems 
Handbook. These schematics are augmented by 
photographs of major components and 
structures. 
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Data Processing System Dictionary 


The Data Processing System Dictionary (DPS 
DICT) contains a compendium and explanation 
of all DPS displays onboard the orbiter. It also 
has program notes on software limitations and 
peculiarities with corrective instructions. It is 
no longer flown as a piece of FDF, but is still 
updated for use on the ground. 


Payload Systems Data/Malfunction Book 


The Payload Systems Data/Malfunction (PL 
SYS DATA/MAL) Book, detailed in the Off- 
Nominal section, can also be considered a 
reference document because of some of the 
payload-related data it contains. 


Maps and Charts Book 


The Maps and Charts Book contains landing 
charts, an orbit map (with a movable 3- 
revolution groundtrack), star charts, and a 
World Atlas. The World Atlas also contains a 
list of Earth sites for observation and 
photography. Although the Maps and Charts 
Book controls these media, they are stowed as 
separate items on the flight deck and middeck. 
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3.4 Reference Documents 


3.5 OPERATIONAL USE 


CONTENTS 


FDF Fabrication 
Preliminaries 


FDF Fabrication 


Materials acquired for the fabrication of Flight 
Data File (FDF) articles or for in-flight supplies 
fall under four categories: 


e Printed material (print shop products, 
photos, maps) 


e Commercial materials (paper boards, pens, 
markers, ring binders) 


e JSC components (edge labels, map frames, 
accessory bags) 


e Certified and approved materials with 
Federal Stock Numbers purchased through 
the JSC Stores Stock Catalog 


These items used by FDF Operations must be in 
compliance with current safety, reliability, and 
quality assurance (QA) standards, or in receipt 
of a Material Usage Agreement (MUA) waiver. 
Annex E of the CPMP identifies the documents 
containing these standards and describes the 
physical dimensions of all JSC fabricated FDF 
items used onboard the orbiter. 


Considering the tremendous volume of critical 
information being presented in the shuttle FDF, 
it is essential that special symbols be used to 
abbreviate procedures. 


Preliminaries 


Development of the FDF for a mission normally 
starts about 1 year prior to the launch date. The 
preliminary work for payloads may start as 
much as 2 years prior to launch. The earliest 
FDF official publications (typically the Flight 
Plan and payload related books) are designated 
as Preliminary documents. These books are 
published approximately 8 months prior to the 
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launch date, after the Cargo Integration Review 
(CIR). Preliminary documents are not under 
the formal change control of the CPCB. 
Accordingly, they аге under continual 
development, and changes may be made 
informally by any cognizant individual by 
working through the book manager. 


comma—read*..and...” 

slash—read‘..and/or...” 

parentheses—read”...or...” 

or chevron — read “exit” 

checkmark—read “verify ...” or “check...” or “check with...” 
+ plus followed by space then value—read as 'add" 

plus followed by value without space—read as “positive” 

minus followed by space then value—read as mathematical “subtract” 

minus followed by value without space—read as “negative” 

up arrow—upper limit exceeded 

down arrow—lower limit exceeded 

delta—read "change" 


* double dot—indicates that preceding data is to be highlighted in flight 
book 
vertical line—read "...or..."between alternate conditional statements 
vertical bar—in page margin to indicate change in procedure since last 
publication 
171 dotted box—encloses alternate or optional steps 


хо» Vertical stars—brackets contingency steps 


[Г] box— DPS display callout 
L1 box—Tread "block n" which refers to corresponding block of procedures 


FDF Symbols 


Basic 


Approximately 4 months prior to the launch 
date, the Basic editions of all flight-specific/ 
supplement FDF are published. The documents 
are now under the configuration control of the 
CPCB and all changes must be requested 
through formal channels that include approval 
by cognizant personnel. Generic documents are 
also subject to these formal change 
requirements, although their publication cycles 
are independent of mission cycles. Only those 
Generic books that incorporate temporary 
flight-specific pages will normally require 
changes during the FDF preparation for a 
specific mission. About 3 weeks after the 
publication of the Basic FDF document, a Flight 
Operations Review (FOR) is held at JSC. The 
FOR is a formal review of payload related 
documents that the flight crew and ground 
controllers will use for training and flight. It 
also provides a forum to verify that authorized 
customer requirements have been met and that 
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safety and shuttle operational requirements 
related to payload operations are correct. 
Representatives from the Flight Crew 
Operations and Mission Operations 
Directorates, Shuttle Integration and Operations 
Office, customer personnel, and other NASA 
personnel, as required, are invited to attend. 
These representatives may submit Discrepancy 
Notice (DN) forms regarding additions (for 
existing requirements), deletions, or 
modifications to any FDF document under 
review for that specific flight. The DNs are 
evaluated by the book manager who 
recommends approval, disapproval, ог 
withdrawal to the FOR “preboard.” DNs 
recommended for disapproval or withdrawal 
will be reviewed in “splinter” meetings as 
required. Final action on all of the DNs is taken 
by the formal FOR board, which is chaired by 
the Manager, Space Shuttle Integration and 
Operations, and made up of management 
personnel representing the mission payload(s) 
and NASA directorates. DNs receiving an 
approval will usually be incorporated into the 
next publication cycle of the appropriate 
document. If the data are critical to crew 
training, the material will be immediately 
incorporated into ай pertinent training 
documents via simulation packages (Sim Pacs). 


482 


Subsequent to the FOR, changes to FDF must be 
made via a Crew Procedures Change Request, 
JSC Form 482-B. The 482 process is detailed in 
CPMP Annex B. As before, anyone may submit 
a 482 requesting a change to a particular FDF 
document. The 482 will be reviewed by 
cognizant personnel апа approved ог 
disapproved. Disapproval by anyone in the 
review process causes the 482 to be 
dispositioned by the CPCB. There is an 
appellate process for 482s disapproved at the 
CPCB through the appropriate Level II board. 
An alternative method of changing minor FDF 
material is available via an EZ 482. This form 
requires much less review and fewer signatures, 
but its use is quite limited and only available 
from the book manager. 


Approximately 4 months prior to flight, the 


crew determines the allowable additions and 
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deletions to the quantities of FDF documents 
and supplies they wish to have onboard. 


482 Start 
A 
| | 
Initiator_Org Stop 
Internal Review 482 
Group and 
Branch Chief 


Жэн 


РМО |4 CPCB Override 
Processing |>! Бер 
Evaluators 
FDF 
Manager 
Book лал Disposition 


Manager | бы 
Implement 
Record Implementation Change 
Initiator 
Verify 
Implement 
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482 Flow 
Initiator 
(Book Mgr) 
Ї ЖСРСВ Member and 
7 ~~ Flight Director 
Ы | coordination required 
у only if after Crew ЕРЕ 
Review 
FDF 
Management —|— —»| Book Mgr 
Office 
КЕП Мк 
FDF Ops 
(File Original in Distribution 
Master 482 File "7779 (Limited) 
- FDF Office) 
usa007587 800r1.cnv 
EZ 482 Flow 
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Final 


Approximately 6 weeks prior to flight, the Final 
versions of flight-specific/supplement FDF 
documents are published. Changes can still be 
made to the FDF after publication of the Final 
version via a 482. Changes that affect a small 
percentage of the pages in a book will normally 
be implemented with a Page Change Notice 
(PCN). When more than one half of the pages 
must be reprinted, or many affected pages are 
scattered throughout a book, a complete 
revision (REV) will be printed. Other 
authorized changes may be implemented via an 
Errata Pack. These changes may be pen and ink 
modifications or reprints of a particular page. 
Technical modifications of the flight documents 
by the crew during their review will be 
promulgated in an Errata Pack subsequent to 
the completion of a 482. A duplicate copy of the 
FDF is available to the crew while they are in 
quarantine at JSC. The prime and an identical 
backup set of the FDF are configured for flight 
and shipped to KSC separately. 


Flight 


The crew has access to the backup copy of the 
FDF while in the crew quarters at KSC. On 
launch day, FDF representatives turn over the 
carry-on FDF to the astronaut support person 
(ASP), who installs the appropriate FDF 
documents for launch. The suit technicians lay 
out the other carry-on FDF for the crew to stow 
in their FDF bags. After the crew has ingressed, 
the ASP makes the final installations and 
adjustments of the cue cards, flip books, and 
checklists. Although the number can vary 
slightly for a particular mission or crew, at 
launch there are about 7 copies of the 3 ascent 
related checklists, 5 flip books, and 34 cue cards 
out/mounted for the crew’s use. The checklists 
are attached to lanyards, while the cue cards 
and flip books are affixed with Velcro. 
Additional cue cards and checklists are readily 
available to the crew in the CDR/PLT’s FDF 
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containers and the MS’s FDF bags for certain 
low probability contingencies. The CDR and 
PLT post insertion checklists are also stowed in 
the FDF containers. 


Approximately 1 hour after launch, when the 
crew transitions to the Post Insertion Checklist, 
MS 3 retrieves selected FDF from a middeck 
locker. Items not needed right away are usually 
placed in a stowage bag on the back of the CDR 
or PLT's seat. At this time, ascent-related 
material is stowed in a helmet bag and placed 
into a “return to Houston” stowage bag. 
Subsequent to Mission Control’s “GO for orbit 
ops,” the crew may unstow additional FDF as 
required. FDF control during the on-orbit 
phase of the mission is basically a crew 
decision. There are certain contingency FDF 
documents (CONT Deorbit, Entry, Entry PCL) 
that should be readily available. Others may be 
mounted in a convenient place in the orbiter, 
stowed in a temporary location, or stowed in 
the FDF locker. Prior to the last sleep cycle, the 
crew will begin the stowage of on-orbit oriented 
FDF. During the deorbit preparation phase, the 
crew stows the remainder of their on-orbit FDF 
and installs the Deorbit and Entry Cue Cards, 
Flip Books, and Checklists. 


After landing, the ASP enters the orbiter and 
collects the Deorbit and Entry FDF and places 
them in “return to Houston” bags with the 
other FDF. They are returned to Houston with 
the crew. Kneeboard cards and other items of 
importance to the crew are collected by the suit 
technicians and returned to Houston as soon as 
possible. During postflight debriefings, the 
crew has access to the flown FDF, kneeboard 
cards, and microcassettes to help reconstruct 
events of the mission. The flown FDF is copied 
onto microfiche and after 6 months it is 
transferred to the National Archives іп 
Washington, DC. The backup copies are reused 
if feasible, or destroyed. The crew may request 
portions of the backup material as mementos. 


3. FLIGHT DATA FILE 
3.5 Operational Use 
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МЭ. 
FLIGHT | мазонморк | * FLIGHT DATA FILE 
PHASE EVENT | мазонморк | MODE 
MEMORY SYSTEMS TROUBLESHOOTING 
CONFIG MGMT FLIGHT PROCEDURE PROCEDURES* 


жч |» 91 Ascent Checklist 
First Stage CDR Flip Book 
Ши!” Flip Book Pilot Flip Book 
Second Stage Cue Cards Pilot Overhead Flip Book 
Cue Cards 
Orbital Insertion : а 
Ascent Checklist Ascent Pocket Checklist 


Post-Insertion Coast Post-Insertion Checklist Orbit Pocket Checklist 
STS Malfunction Procedure 
RTLS 2" Stage шиг 25 CDR Flip Book 


Glide RTLS-1 Ascent Flip Book Pilot Flip Book 
Pilot Overhead Flip Book 


| Glide-RTLS-2 — | | Glide-RTLS-2 | 2 Cue Cards 
| Orbit Coat | | Orbit Coat | 


Orbital Maneuver ae Insertion Checklist 

Flight Plan Orbit Pocket Checklist 
On-Orbit Checkout Orbit Operations Checklist Cue Cards 

Payload Checklists STS Malfunction Procedures 
Orbit Operations Deorbit Preparation 

Ern 
Payload Bay Door Operations | 202, 402 | 402 
Predeorbit Coast Deorbit Preparation Checklist 

Entry Checklist 
Deorbit Maneuver . | 

Entry Checklist Entry Pocket Checklist 
Early Entry Cue Cards CDR Flip Book 

Pilot Flip Book 


|TAEMILandng = 


Post-Landing —— Checklist Pilot Overhead Flip Book 
Cue Cards 


* During ascent and entry, the Mission Specialist uses the Ascent/Entry Systems procedures. 


** Major modes separated by a dashed line have automatic transitions from one to the next. Major Mode discussion is in Section 2.6, Data Processing 
System 


Shuttle Mission Overview 
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хло' 14108 89/0085 


1/0 Адия 
Jo/pue SUA 


TAEM to postlanding 


WAVL 


El - 5 minutes 


EREK 
speg әпо 
sXoog 914 


1/0 Адия 


шш с 


End of деогой burn 


to El - 5 minutes 


ШЕ 


МӘәтАЛӘАС) UOISSTIA әс 


шпа 1910эа 


Ж 


удога 


Кер | snuiw ұсроәа 
jnox»eu?) S24 


108 


зелпрезола зиозэипуей шоу биол 


злелпеџеш ачо 


әбиецо грош ogeuiojny — — — 


(p,bei у) L-SINO 


SdO Q8 ld 
coc 


Completion of OMS-2 to 
OPS transition GNC OPS 


SpJe2 eng 
1/9 зөХэод 11910 


o 
e 
x 
© 
9) 
| 


о 580 ао 
џеја 14614 


џођлеви 
1504 


c SNO x 


2 


Completion of OMS-1 
(if req'd) 
to completion of OMS-2 


әбиецо грош јепивуј 


des gus 


des 13 


ET Sep to completion 


of OMS-1 burn 


(If req'd) 


30-1 


OO3N 


SRB Sep to ET Sep 
maneuver complete 
Launch to SRB Sep 


dSav 
spied ano 
sXoog 914 


7/9 1ueosy 


Т - 0:20 


Т-20 тт to launch 


є|во seyew 
STIS 


Т - 2:25 


Major Mode 
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4. OPERATING LIMITATIONS 


CONTENTS 


INSTRUMENT MARKINGG.... 
ENGINE LIMITATIONS 
AIRSPEED LIMITATIONS 
ANGLE OF ATTACK 


LANDING WEIGHT 


LIMITATIONS 
DESCENT RATE 
LIMITATIONS 
CENTER OF GRAVITY 
LIMITATIONS 
ACCELERA 


4.10-1 


This section delineates limitations for selected 
orbiter systems, equipment, and operations. It 
is not all inclusive. Limitations that the flight 
crew should be aware of һауе been 
emphasized. It must be noted that operations 
up to and including the given limits for one 
system may cause a violation of the limits for 
another. An example would be flying at the 
flight control system maximum allowable knots 
equivalent airspeed (KEAS). This KEAS would 
overspeed the landing gear with a lower 
maximum allowable KEAS. 


“Limitations are those measurable or detectable operational limits, which 
if exceeded, will affect crew safety or result in performance degradation.” 


4-1 


4. OPERATING LIMITATIONS 
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4. OPERATING LIMITATIONS 4-2 


41 INSTRUMENT MARKINGS 
CONTENTS 


Description 
Panel F9 Meters 


Panel O1 Meters 
Panel O2 Meters 
Panel O3 Meters 


Description 


Instrument markings reflect the normal range 
(green) and upper/lower limits (red). Caution 
and warning alarms/tones will normally sound 
at the points marked in red. In some cases an 
SM alert will sound prior to the limits on the 
meters being reached. The meter indications in 
this section are arbitrary and are not intended to 
reflect actual flight conditions. For MEDS, 
vehicles, see section 2.18, MEDS for OMS/MPS, 
HYD/ APU, SPI, and Flight Instruments. 


Alpha/Mach Indicator 


The MEDS alpha tape displays a maximum lift- 
to-drag (L/D) diamond. The diamond position 
is a linear interpolation of table values. For 
Mach <0.95, the diamond is fixed at 10.5°. 


The MEDS alpha tape also displays a green bar 
indicating maximum and minimum alpha limits 
on entry. The maximum and minimum 
positions are a linear interpolation of a table of 
values based on the current flight rule limits. 


Entry PFD 
with Alpha Tape Markings 


4.1-1 


054007587 
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Subsystem Status MEDS Display 


The meters on panels F7 and F8 have been 
removed and replaced with a MEDS display. 
The following parameters can be viewed by 
depressing the SUBSYSTEM STATUS key on 
the MEDS toolbar and then selecting the appro- 
priate subsystem (OMS/RCS, HYD/APU, SPI). 

Normal operating ranges are LE 
indicated by: ГЫ 
High/low limits are indicated 


o 143 © 287 ізі 575 719 863 1007 1151 
шоу а а ra nnd ши 


0М5 МР5 | 1 
TERM 
3 L R PNEU XXXX] RA 
3 ХХХХ | ХХХХ ХХХХ xox] | poox © 
PEE 

j He не (7 | 
Е тк ТАМК TANK 
Е Р || L P P 

~ t3 Е ш ы ш 


L R ENG MANF 12 |xxxx| RB ко 
хххх | |хххх 102 ін? хххх хххх © 

хххх] [xxxx m L L 

- - P 
Pc Pc Pc 
51 % % | 
А = = = 
6 6 6 © © 


@ L OMS He TK PRESS meter LENG He TK PRESS meter 
(2) R OMS He TK PRESS meter (9) C ENG He TK PRESS meter 


(5) 102 ENG МАМЕ PRESS meter 
© LH2 ENG MANF PRESS meter 


(8) L OMS N2 TK PRESS meter (0) R ENG He TK PRESS meter (ТУІ ENG Pc meter 


@ ROMS м2 TK PRESS meter (1) PNEU Не REG PRESS meter C ENG Pc meter 


© Loms Pc meter (0) LENG He REG PRESS тег (9) В ENG Pc meter 


(8) ROMS Pc meter (3) C ENG He REG PRESS meter 


(0) PNEU He TK PRESS meter (0) R ENG He REG PRESS meter 1078.CNV 


OMS/MPS MEDS Display 


OMS PRESS Pc Meter 


The left and right Pc (thrust chamber pressure) 
is measured by a sensor that is routed through a 
dedicated signal conditioner (DSC) before being 
displayed on the OMS/MPS display and sent to 
the GPCs. 


OMS PRESS N2/He Tank Meter 


Separate N2 and He pressure sensors (left and 
right) are wired through a DSC to the 
OMS/MPS display and GPCs.  Redundant 
pressure sensors provide the pressure readings 
for N2 and He on the GNC SYS SUMM 2 
display. 


4. OPERATING LIMITATIONS 
4.] Instrument Markings 
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Meter Meter Marking(s) Marking Explanation(s) 
OMS He TK P <1500 psia (red) Low limit (Class 3 C/W) 
(L, В) 
OMS №2 TK P <1200 psia (red) Low limit (Class З C/W) 
(L, В) 
OMS Pc % 95 - 110% Pc (white) Normal operating range 
L,R 
ua «8076 Pc (red) Low limit (Class 2 C/W) 
7296 Pc allowed during ullage 
blowdown 
21165 (appx) Off-scale high (Class 2 C/W) 
A value of 160 is displayed in red 
and the Pc box goes red 
MPS HE TANK P «1150 psia (red) Low limit (Class 2 C/W) 
(C, L, R) 
MPS HE REG AP 2810 psia (red) High limit (Class 2 C/W) 
CLR 
( <680 psia (red) Low limit (Class 2 C/W) 
MPS Рс % 65 - 109% Pc (white) Normal operating range 
(C, L, К) (104% Pc is the nominal maximum 
with power available up to 109% Pc) 
MPS PNEU TANK P <3800 psia (red) High limit (Class 3 C/W) 
MPS PNEU REG P >810 psia (red) High limit (Class 3 C/W) 
<700 psia (red) Low limit (Class 3 C/W) 
MPS ENG MANF LO2 2249 psia (red) High limit (Class 2 C/W) 
45-175 psia (green) Normal operating range for LO2 
MPS ENG MANF LH2 >60 psia (red) High limit (Class 2 C/W) 
30-45 psia (green) Normal operating range for LH2 
МР5 PRESS Pc Meter 


The left, center, and right Pc 


pressure) are measured by a sensor that is 


wired via the GPCs through fli 


multiplexer/demultiplexer (MDM) 2, 1, or 3 


respectively, to the OMS/ MPS 
failure of an FF MDM or a data 


cause the affected Pc meter to drop to zero. 
GPC failure and some FF MDM failures can 


cause the affected Pc reading to 


4. OPERATING LIMITATIONS 


4.] Instrument Markings 


(thrust chamber 
ght forward (FF) 


display. Power 
path failure will 


freeze. 


WARNING 


MPS performance has not been verified in 
flight beyond a power level of 104 percent. 


WARNING 


MDM power failure can cause MPS Pc 
indication to drop to zero. Confirm engine 
failure with acceleration cues, MPS He 
consumption, or MCC call. 


MPS PRESS ЕМС МАМЕ Meter 


The LO» апа LH» manifold pressures аге 
measured by a single transducer in each LO» 
апа LH»; line between the ET and SSMEs. 
The data are sent directly to the OMS/MPS 
display and through an MDM to the BFS GNC 
SYS SUMM 1 display. 


MPS PRESS HELIUM and PNEU Meters 


The pneumatic, left, center, and right He tank 
pressures are measured by a single sensor in each 


USA007587 
Rev. A 


system manifold. Data are sent directly to the 
OMS/MPS display and through an MDM to the 
GPCs for display оп BFS GNC SYS SUMM 1. 


The Pneumatic regulator, Left, Center, and Right 
He Regulator A pressures are measured by a 
single sensor downstream of each regulator. Data 
are sent directly to the OMS/MPS display and 
through an MDM to the GPCs for display on BFS 
GNC SYS SUMM 1. 


Е 


Ч HYDRAULI C ыы 


2 3 


1092.CV5 


HYD/APU MEDS Display 


4. OPERATING LIMITATIONS 
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Meter 


Meter Marking(s) 


Marking Explanation(s) 


Hydraulic Pressure 


2900 - 3200 psia (green) 


Normal operating range 


2400 psia (red) Low limit (Class 2 C/W) 
500 - 1000 psia (green) Normal “low pressure” operating 
range 
Hydraulic Quantity 40 - 80% (green) Normal operating range 
>95 or <40% (red) SM alert sounds 
Fuel Quantity >20% (green) Normal operating range 


<20% (red) 


SM alert sounds at 20% 


Fuel Pressure 50 - 370 (green) 


Normal operating range; however, it 
would require multiple failures 
before the pressure could reach 50. 
SM alert sounds at 100 and 350 psia 


110 psia (red) Low limit for hot restart 
Water Quantity >40% (green) Normal operating range 
<40% (red) SM alert sounds at 40% 
Hydraulic Pressure Meter Fuel Quantity 


Three sensors in each hydraulic system measure 
the fluid pressure. The “A” sensor is wired 
through a DSC to the HYDRAULIC PRESSURE 
meter (HYD/APU MEDS display), while the 
“В” sensor provides inputs for the SM SYS 
SUMM 2, SPEC 87 APU/HYD, and SPEC 87 
HYD THERMAL displays. Mission Control has 
access to the data from the “C” sensor via 
downlist data. All three sensors are used for 
priority rate limiting (PRL). PRL status is 
available on the OVERRIDE (SPEC 51) display. 


Hydraulic Quantity Meter 


A sensor located in each of the three hydraulic 
reservoirs provides the information displayed 
on the HYDRAULIC QUANTITY meter and on 
the SM SYS SUMM 2 and SPEC 86 APU/HYD 
displays. Data is sent to the meter and GPCs 
via a DSC. It is also sent to the GPCs via an 
orbiter instrumentation MDM. 


4. OPERATING LIMITATIONS 


4.1 Instrument Markings 


Fuel quantity is determined by a pressure/ 
volume/temperature (PVT) calculation рег- 
formed by the onboard computers. The calcu- 
lated quantity is output to the HYD/APU 
display and to DPS displays SM SYS SUMM 2 
and SPEC 86 APU/HYD. 


Fuel Pressure 


There аге two sensors: one on the N» side and 
one on the fuel side. Both go to the SPEC 86 
APU/HYD display, but only the N2 side sensor 
goes to the meter via a DSC. 


WSB Н2О Quantity 


The НО quantity is determined by a PVT 
calculation based on НО tank pressure and 
temperature transducer readings as well as GN»? 
tank pressure and temperature transducer 
readings. The calculated quantity is output to 
the HYD/APU display and to the SM SYS 
SUMM 2 and SPEC 86 APU/HYD displays. 


Oil Temperature 


Oil temperature in the three APUs is measured 
by sensors located upstream and downstream 
of the water spray boilers. Data from the down- 
stream sensor (OIL IN T) is routed to the OIL IN 
TEMP meter (HYD/APU MEDS display) via a 
DSC. The SM SYS SUMM 2 and SPEC 86 
APU/HYD displays show data from both 
sensors (OIL IN T and OIL OUT T). 


METER MARKINGS(S) MARKING EXPLANATION(S) 


50° - 70° F (green) Normal operating range when APUs 


are off 


200? - 270? F (green) Normal operating range when APUs 


are off 


290? F (red) High limit (Class 2 C/W) 


Panel F9 Meters 


AC VOLTS Meter 


AC phase voltage (A, B, and C) is read directly 
at each of the three buses. There is no AC 
AMPS meter for the AC system that monitors 
AC current. The data is sent to this meter and 
to the SM SYS SUMM 1 and SM SPEC 67 
ELECTRIC displays. 


811.су5 


AC VOLTS Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


115 — 119 (green) Normal operating range 


123 (red) High limit (Class 2 C/W) 


108 (red) 


Low limit (Class 2 C/W) 
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DC VOLTS Meter 


DC voltage is read directly at each fuel cell, 
main bus, and essential bus. The data is routed 
to the meter and to the SM SYS SUMM 1, SPEC 
67 ELECTRIC, and SPEC 69 FUEL CELLS 
displays. 


SIGNAL 
STRENGTH 


/ зав Фу 


Е55 
VOLTS 


2СА Ш 
ВС” 


© 


812.су5 


DC VOLTS Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


28 — 32 (green) Normal operating range (SM alert at 


32.5) 


26.4 (red) Low limit (Class 2 C/W) 


DC AMPS/SIG STR Meter 


A current sensor for each of the three fuel cells 
provides an input to the DC AMPS/SIG STR 
Meter. (“SIG STR” refers to S-band signal 
strength that is also monitored on this meter.) 
Essential and main bus current are not 
monitored. The data also appear on the SM SYS 
SUMM 1, SPEC 67 ELECTRIC, and SPEC 69 
FUEL CELLS displays. 


4. OPERATING LIMITATIONS 


4.1 Instrument Markings 
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0 
ОС АМР5/ ын 
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were ES 
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STRENGTH 


/зав 
Е55 
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D (52) 


813.су5 


DC AMPS/SIG STR Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 
90 — 350 A (green) Normal operating range 


Panel O1 Meters 


AIR TEMP, Н:О PUMP OUT 
PRESS Meter 


Cabin Heat Exchanger Air Temperature 


Temperature data from a sensor downstream 
from the cabin heat exchanger are sent directly 
to the dual function AIR TEMP Meter and are 
also available on the SM SYS SUMM 1 and 
SPEC 66 ENVIRONMENT displays. 


Avionics Bay Air Temperature 


Temperature data from а sensor located 
downstream of the avionics bay fans are sent 
directly to the AIR TEMP Meter. These data are 
also available on the 5M SYS SUMM 2 and 
SPEC 66 ENVIRONMENT displays. 


METER MARKINGS(S) MARKING EXPLANATION(S) 


75° — 110% F (green) 
130° F (red) 


Normal operating range 


High limit for avionics bay air temp 
(Class 2 C/W) 


4. OPERATING LIMITATIONS 


4.1 Instrument Markings 


Н20 
РУМР 00Т 
PRESS 


AIR 
TEMP 


0 
IW X10] X10 2 


V. 2 


AIR TEMP, H;O PUMP OUT PRESS Meter 


METER MARKINGS(S) 


50° — 60° F (green) 


MARKING EXPLANATION(S) 


Normal operating range 


Н:О Pump Out Pressure 


Sensors in water loops 1 and 2 send data to this 
meter via a DSC and to the SM SYS SUMM 2 
and SPEC 88 APU/ENVIRON THERM displays 
via an MDM. Certain preconditions must exist 
for the C/W system to activate at the values 
listed below. Those preconditions are found in 
the FDF Reference Data book. 


METER MARKINGS(S) MARKING EXPLANATION(S) 


Loop 1 
55 — 65 psia (green) 
79.5 (unmarked) 


Normal operating range 
High limit (Class 2 C/W) 
Low limit (Class 2 C/W) 


19.5 Psia (red) 

Loop 2 

55 — 65 psia (green) 
81 psia (red) 

45 psia (red) 


Normal operating range 
High limit (Class 2 C/W) 
Low limit (Class 2 C/W) 
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NOTE 


SM alerts will occur at 75 psia (high) and 
50 or 20 psia (low), depending on pre- 
conditions for both loops. 


FREON FLOW, 
EVAP OUT TEMP Meter 


Flow 


А sensor located upstream from the Н2О/ 
Freon Interchanger in Freon Loops 1 and 2 
provides a readout of Freon interchanger flow 
directly to the meter and to the SM SYS SUMM 
2 and SPEC 88 APU/ENVIRON THERM 
displays. 


FREON ———34 
EVAP OUT 


TEMP 


FLOW 


815.cvs 


FREON FLOW, EV AP OUT TEMP Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


2300 — 2500 psia 
(green) 


Normal operating range (Flow 
Proportioning Valve in Payload (PL), 
SM alert at 1300 psia) 


1400 — 2200 psia 
(green) 


Normal operating range (Flow 
Proportioning Valve in Interchanger 
(ICH), SM alert at 1950 psia) 


[Change pending to meter markings 
to reflect C/W limits] 


1200 psia (red) Low limit (Class 2 C/W) 
B Bypass 


R Radiator 


Evaporator Out Temperature 


A sensor located downstream from the flash 
evaporator in each Freon Loop 1 and 2 provides 
data directly to the meter and to the 5M SYS 
SUMM 2 and SPEC 88 APU/ENVIRON 
THERM displays. 


METER MARKINGS(S) MARKING EXPLANATION(S) 


38° — 40° Е (green) Normal operating range 


65* F (red) High limit (Class 2 C/W) 


32° F (red) 


Low limit (Class 2 C/W) 


CABIN dP/dT PSIA/MIN, 
O2/N2 FLOW Meter 


Cabin dP/dT 


The indication on this meter is a direct readout 
of the dP/dT sensor. The data are also 
transmitted to the SM SYS SUMM 1 and SPEC 
66 ENVIRONMENT displays. The DPS 
displays also contain an additional backup 
dP/dT supplied by computations. 


O2/N2 Flow 


An C2 and М2 flow sensor in the two pressure 
control systems (four total) send data directly to 
the O2/N2 FLOW Meter. The readings are also 
available on the SM SYS SUMM 1 and SPEC 66 
ENVIRONMENT displays. 


METER MARKINGS(S) MARKING EXPLANATION(S) 


0.0 — 0.75 pph (green) 


Normal operating range 


4.9 pph (red) High limit (Class 2 C/W) 


4. OPERATING LIMITATIONS 


4.] Instrument Markings 
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CABIN 
ар/ат 02/№ 
PSIA/MIN FLOW 


816.cvs 


CABIN dP/dT PSIA/MIN, 
O2/N2 FLOW Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


0.0 psia (green) Normal operating range 


-0.08 psia (red) Low limit (Class 2 C/W) 


CABIN 
PRESS РРО2 


С к 
9(5 6) eye 


SENSOR B 


817.cvs 


CABIN PRESS, РРО; Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


14.3 — 14.7 psia Normal operating range 
(green) 


15.2 psia (red) High limit (Class 2 C/W) 


13.8 psia (red) Low limit (Class 2 C/W) 


PPO? 


Dual selectable sensors (A or B) send data 


directly to this meter and for the SM SYS 
CABIN PRESS, PPO: Meter SUMM 1 and SPEC 66 ENVIRONMENT 
displays. 


Cabin Pressure 


A cabin pressure sensor provides a direct indi- 
cation for this meter and for the SM SYS SUMM 1 
and SPEC 66 ENVIRONMENT displays. (The 
airlock pressure on the CRT ENVIRONMENT 
display can be used as a backup.) 


4. OPERATING LIMITATIONS 4.1-8 


4.] Instrument Markings 


METER MARKINGS(S) MARKING EXPLANATION(S) 


2.95 — 3.45 psia Normal operating range 
(green) 


3.6 psia (red) High limit (Class 2 C/W) 


2.7 psia (red) Low limit (Class 2 C/W) 


Panel O2 Meters 


CRYO О; НТК ASSY TEMP Meter 


A temperature sensor in each of the eight O2 
tank heater assemblies monitors the tempera- 
ture of warmed O2 and sends the data via a 
DSC to this meter and the SM SYS SUMM 2 and 
SPEC 68 CRYO SYSTEM displays. 


02 HTR 
ASSY TEMP 


818.су5 


CRYO О» НТК ASSY TEMP Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


-300° — +200° F Normal operating range 


(green) 


+349° F (red) High limit (Class 2 C/W) 


NOTE 


For OV-105, the METER TANK SELECT 
switch will show HTRS 1 and 2 for tank 5 
as well. 


4.1-9 
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CRYO О: PRESS Meter 


One sensor for each of the О» tanks provides 
pressure data via a DSC to the meter and SM 
program while another sensor (heater 
controller) sends data to the SM SYS SUMM 2 
and SPEC 68 CRYO SYSTEM displays. 


TK1 AN TK5 
TK2 TK4 


TK3 
(58) 


819.су5 


CRYO О, PRESS Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


802 — 930 psia (green) Normal operating range 


985 psia (red) High limit (Class 2 C/W) 


540 psia (red) 


Low limit (Class 2 C/W) 


NOTE 


SM alerts occur at 960 psia (high) and 575 
psia (low), with heaters not in AUTO or 
740 psia (low) with A or B heater in 
AUTO. 


CRYO H» PRESS Meter 


One sensor for each Нь tank provides pressure 
data to the meter via a DSC and SM software, 
while another sensor (heater controller) sends 
data to the SM SYS SUMM 2 and SPEC 68 
CRYO SYSTEM displays. 


4. OPERATING LIMITATIONS 


4.] Instrument Markings 
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FUEL CELL 
STACK 
TEMP. 
820.су5 
СКҮО Н; РКЕ55 Мегег МЭТ 
МОТЕ CRYO FUEL CELL STACK TEMP Meter 
Tank 5 SELECT position is included on MARKING EXPEANATION(S) 
OV-105. 190° — 225° F (green) Normal operating range 


243.7° F (red) High limit (Class 2 C/W) 


METER MARKINGS(S) MARKING EXPLANATION(S) 


200 — 250 psia (green) Normal operating range 


172.5° F (red) Low limit (Class 2 C/W) 


293.8 psia (red) High limit (Class 2 C/W) 


NOTE 
153 psia (red) Low limit (Class 2 C/W) 
SM alerts occur at: 
NOTE High Low If FC Output is: 
SM alerts occur at 283 psia (high) and 165 (1) 212°F 180°Е Less than 3.5 kW 
psia (low) with heaters not in AUTO, or (2) 222°F 190° F 35-75 kW 
шоо (low) жаш Ао В heater <n (3) 238°F 198°Е More than 7.5 kW 
CRYO FUEL CELL 
STACK TEMP Meter 


A sensor in each of the three fuel cell systems 
measures the temperature of the coolant leaving 
the fuel cell stack and sends the data via a DSC 
to this meter and the SM SYS SUMM 1 and 
SPEC 69 FUEL CELLS displays. 
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Panel ОЗ Meters 
RCS/OMS PRESS LEFT/FWD/ 
RIGHT OXID, FUEL Meter 


RCS/ OMS/ PRESS 
FWD/KIT 
OXID FUEL 


LEFT 
OXID FUEL 


w 
© 
© 


ГТТТТТТТТТТТЦТТТ 
- N 
о о 
© © 
Hrita ај E 


Ф TEOM genes 


S 


He X10 OMS PRPLT 


T 
PRPLT 


RCS 


822.cvs 


RCS/OMS PRESS LEFT/FWD/RIGHT OXID, 
FUEL Meter 


METER MARKINGS(S) MARKING EXPLANATION(S) 


235 — 255 psia (green) Normal operating range 


312 psia (red) High limit (Class 2 C/W) 


200 psia (red) 


Low limit (Class 2 C/W) 
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RCS Pressure 


RCS oxidizer, fuel, and helium (X10) pressures 
are displayed for the left, forward, and right 
systems by way of dual sensors. One sensor 
sends data via a DSC to the meter and the SPEC 
23 RCS display, while the other routes data via 
a DSC to the GNC SYS SUMM 2 display. RCS 
pressure limits/normal ranges are marked on 
the left side of the meters and are identical for 
oxidizer and fuel. 


NOTE 


There are no He limits marked on the 
meters. An SM alert is generated if He 
pressure reaches 500 psia (low). 


OMS Pressure 


OMS oxidizer and fuel pressures are displayed 
for the left and right systems by way of a single 
sensor in each tank. The sensors send data via a 
DSC to the meters and the GNC SYS SUMM 2 
display. OMS limits/normal ranges are marked 
on the right side of the meters and are identical 
for oxidizer and fuel. 


METER MARKINGS(S) MARKING EXPLANATION(S) 


245 — 255 psia (green) Normal operating range 


284 psia (red) High limit (Class 3 C/W; Class 2 and 


BFS C/W at 288 psia) 


232 psia (red) 


Low limit (Class 2 hardware C/W; 
software 234 psia) 
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4. OPERATING LIMITATIONS 4.1-12 


4.1 Instrument Markings 


4.2 ENGINE LIMITATIONS 


CONTENTS 


Space Shuttle Main Engines 


Orbital Maneuvering System 
(OMS) Engines 
Reaction Control System (RCS) Jets .. 


Space Shuttle Main Engines (SSMEs) 


Power 


The SSMEs are designed to operate from 65 
percent Pc to 109 percent Pc above 8,700 MSL. 
The GPCs can command the engines only 
within this Pc range. The following chart shows 
minimum Pc’s for altitudes below 20,000 ft. 
MSL. The engines are limited to 736 seconds of 
operation in the range of 65 percent to 104 
percent Pc. 


WARNING 
Shuttle MPS in flight performance has not 


been verified beyond a power level of 104 
percent Pc. 


109- 

2109 Acceptable 

х 80- ““- operating 

2 E range 

= 601- ee 

Ф 

5 

a 404- 65% at 8,700 Ft 

2 

“ә 20- 

= 

ui 
0 | | | | | | | | 
0 5,000 10,000 15,000 20,000 


Altitude (ft) 


Minimum throttle vs. Altitude constraint 


Minimum main engine Altitude above 


power level sea level 
(%RPL) (ft) 
90.0 0 
82.0 2,500 
76.0 5,000 
68.0 7,500 
65.0 > 8,700 


823.cvs 


Pc Chart 
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SSME Temperature 


Mission Control Center (MCC) personnel 
monitor three critical engine temperatures: 
high pressure fuel turbopump (HPFT) high 
temperature, high pressure oxidizer turbopump 
(HPOT) high temperature, and HPOT low 
temperature. Temperatures exceeding any of 
their limits will result in a main engine 
shutdown, unless the crew has manually 
inhibited the shutdown limits via the MAIN 
ENGINE LIMIT SHUTDN switch. The red 
Main Engine STATUS light will illuminate, 
regardless of the position of the switch, if any 
one of these limits is exceeded. The crew has 
insight into the GO2 OUT T (outlet 
temperature), which is found on BFS GNC SYS 
SUMM 1. This temperature varies directly with 
engine power levels and can be used by the 
crew to determine if the engine is failed. An SM 
alert is annunciated when this value drops 
below 125°. 


Propellant Pressure 


MCC personnel monitor two critical pressures 
that are not available on crew displays: HPOT 
intermediate seal purge pressure-low and main 
combustion chamber pressure-low. Pressures 
exceeding any of their limits will result in a 
main engine shutdown, unless the crew has 
manually inhibited the shutdown limits; the red 
ME STATUS light will illuminate regardless of 
the position of the switch. In addition to the 
main propulsion system (MPS) manifold LH2 
and LO2 pressure limits indicated on the ENG 
МАМЕ meter (MEDS OMS/MPS display), ап 
SM alert will sound if MPS ULL P (ullage 
pressure), on BFS GNC SYS SUMM 1, for LH2 
or LO2 reaches the indicated 
maximums/ minimums: LH2 34.0 psi/28.0 psi, 
ГО? 29 рвї/0 psi. The crew has insight into the 
GH2 OUT P (outlet pressure), which is found 
оп BFS GNC SYS SUMM 1. This pressure 
varies directly with the engine power level and 
can be used by the crew to determine if the 
engine is failed. An SM alert is annunciated 
when this value drops below 1050 psi. 


Engine Nozzle Position 


The MPS nozzles have sufficient dynamic 
envelope such that they can collide with one 
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another, OMS engine nozzles or pods (upper 
SSME), or the body flap (lower SSMEs). The 
crew cannot monitor this envelope. Post 
MECO, the GPCs will position the nozzles to 
prevent interference and control entry heating 
on the lower engine nozzles. SODB Vol 1, 
section 3, and The Shuttle Performance Analysis 
Databook (SPAD), Chapter 6, graphically depict 
the nozzle envelopes. 


MPS He Pressure 


The first indication of a He leak will be an SM 
alert annunciated when the He dp/dt exceeds 
20 psi for three BFS cycles. The He dp/dt, 
along with other MPS He pressures, is available 
on BFS SYS SUMM 1 (He dp/dt is only 
available in OPS 1). In addition, MPS He TK P 
(tank pressures) and REG P. A (regulator A 
pressures) are also available on the MEDS 
ОМ5/ МР5 display. 


C&W for Мат Engine He Pressure 


МЕ He Tanks low | — 1150 


Regs low 679 


Regs high 810 


Pneu He tank low 


Accum low 


SSME AC Power 


SSME controller operation requires that all 
three ac phases and voltages must not fall 
below 100 volts RMS (root mean square) for 
longer than 500 msec. Should this happen, 
channel switchover (A to B) or engine 
shutdown will occur. 


Engine Electric Lockup 


An electric lockup will occur if the main engine 
controller loses both channels of Pc or fuel flow 
meter data. This will cause the controller to 
maintain the last commanded throttle position. 
The crew will see the corresponding amber 
MAIN ENGINE STATUS light illuminate and 
an MPS ELEC (L,R,C) message. 


Engine Hydraulic Lockup 
The engine design specifications state that the 


engine must operate if hydraulic pressure is 
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greater than 1500 psia and that it must go into 
hydraulic lockup below 1100 psia. The loss of 
hydraulic pressure (any pressure below 1500 
psia) will initially send the engine valves into 
“soft lockup.” Soft lockup implies that none of 
the five engine valves has failed their channel A 
and B actuator position checks. If no new 
throttle commands are being executed, it may 
take up to 1 minute for the valves to fail their 
actuator checks. If hydraulic pressure is 
recovered prior to failure of the position checks, 
the engine can come out of soft lockup and 
normal engine operation can resume. A “hard 
hydraulic lockup” will occur when any of the 
five engine valves fail their channel A and B 
actuator position checks. The controller soft- 
ware will then command all the valves to their 
last commanded position before the lockup 
occurred. The crew will see the corresponding 
amber MAIN ENGINE STATUS light illuminate 
and ап MPS HYD (L,C,R) message. 


Orbital Maneuvering System (OMS) 
Engines 


Engine Chamber Pressure 


There is no maximum Pc for the OMS engines 
due to the stoichiometry of the fuel/oxidizer 
mixture. Except during ullage blowdown, the 
OMS Pc should never fall below 80 percent. 
Operation with low Pc may cause engine 
damage or combustion instability. 


Engine Operations 


The engines are not rated for use below 70K feet 
due to exhaust flow separation and damage to 
the nozzles. With normal engine shutdown 
purge the following limitations apply: (1) 
engine firings of less than 2 seconds are 
prohibited due to possible propellant freezing 
or hard starts; (2) the minimum engine off-time 
between firings is 240 seconds for normal 
operations and 30 seconds for launch abort 
operations (15-second minimum burn) due to 
possible propellant freezing or hard starts. 
Without normal engine shutdown purge, the 
off-time increases to 10 minutes (for burns more 
than 10 seconds). 


4.2-2 


CAUTION 


OMS engines must never be interconnected 
to use RCS propellant during OMS burns 


due to the smaller volume of the RCS tanks 
and the large propellant flow required by 
the OMS engines. RCS propellant tank 
damage will result. 


Engine Temperature 


The only OMS temperature monitored is the 
fuel injector temperature. This temperature is 
used to assess engine burn stability. 


A fault message will be generated if the fuel 
injector temperature in either OMS pod exceeds 
260° F (indicative of low or high fuel inlet 
pressure). 


Engine Propellant 


If the OMS propellant quantity is less than 11 
percent, an RCS settling burn should be 
accomplished prior to OMS ignition. OMS 
propellant quantity should be less than 22 
percent to remain within the structural limit 
for landing. 


Engine Nozzle Position 


If a nozzle moves more than 0.7° from its 
stowed position, a fault message will be 
generated to the ground and crew. If MCC is 
satisfied that it has moved more than 1.5° 
inboard or up during the maximum q-bar 
regime of ascent, the OMS engine will not 
be fired. 


Engine N2 Pressure 


The minimum nitrogen pressure for starting an 
OMS engine is 299 psi (254 psi for contingencies 
though abnormal start could occur) Тһе 
maximum number of starts that can be 
supported with the N2 system is 17. 
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Reaction Control System (RCS) Jets 


Jet Operations 


The maximum nominal firing duration for 
forward and aft primary jets is 150 seconds, or 
300 (-X forward RCS) and 800 (+X aft RCS) 
seconds for contingencies. Verniers are limited 
to 275 seconds in any 24-hour period. The 
GPC’s will limit the number of simultaneous jet 
firings. The limit varies from 4 to 7 jets per pod, 
depending on propellant quantity, flight phase 
(mated coast, ET Sep, dump, etc.), and abort 
mode (norm, RTLS, TAL, etc.). A nominal ET 
separation requires the use of RCS from all 
three pods. On entry, the aft RCS roll jets are 
deactivated at a q-bar of 10 psf, the pitch jets at 
q-bar of 40 psf, and the yaw jets at Mach 1. 


ET SEPARATION RCS REQUIREMENTS 
Jet Minimum Requirements 
Group 


FWD down 3 
AFT left 3 
AFT right 3 
AFT up 1/side 2/side 
AFT down 1/side 2/side 
FWD yaw - 1/side 
ET Separation Chart 
Jet Propellant 


The propellant tanks are not usable if pressure 
is less than 185 psi. During ascent and orbit 
(also entry when g-load is low) the maximum 
allowable pressure differential between tanks 
prior to initiating a crossfeed is 80 psi. When 
acceleration is between 0 and 1.5 g's, the 
maximum differential is 55 psi. The maximum 
acceleration for initiating a crossfeed is 1.5 g. A 
minimum of 1175 Ib , or 53 percent total aft 
RCS, is required for entry with a c.g. x1095 in. 
For c.g. 21095, 1375 ІР, or 62 percent total 
ARCS, is redlined. 


RCS He Tank Pressure 


The He tanks are considered lost if pressure is 
less than 456 psi. 
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4. OPERATING LIMITATIONS 4.2-4 


4.2 Engine Limitations 


4.3 AIRSPEED LIMITATIONS 


CONTENTS 


Ascent 


The maximum airspeed (based on the q-bar 
limit of 819 psf) for the shuttle fleet is 492 knots 
equivalent airspeed (KEAS) where KEAS = 


м9 = Баг х 17.18 (see figure below). These 


limits are based on thermal protection system 
(TPS) constraints. Flight design planning for 
each mission keeps the vehicle’s airspeed (via 
q-bar) below about 475 KEAS. 


There is no official minimum airspeed for 
ascent. 


820 
800 


Q (PSF) 
103, 104 


~ 
a 
о 


Dynamic Pressure (psf) 


0.80 1.0 1.5 2.0 2.5 
Mach Number 


usa007587 828г2.сух 
Source: NSTS 08934, SODB, Vol. I 


Dynamic Pressure vs. Mach Number 


Entry 


The maximum certified airspeed during entry is 
also a function of q-bar, which varies during the 
descent profile. It reaches a maximum value at 
350 psf or 321 KEAS. This protects for the 
actual limit of 333 KEAS by accounting for air 
data system and gauge tolerances. If the 
maximum flight control limit is exceeded, it is 
possible for the orbiter to go unstable in 
roll/yaw. For contingency aborts, the maxi- 
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mum airspeed limit is 486 KEAS. This is the 
ultimate limit for both flight control and the 
orbiter structure. 


The minimum guidance and control airspeed 
for Mach less than 5.0 is 163 KEAS. The 
minimum practical airspeed below Mach 2.5 is 
based on not flying on the back side of the L/D 
curve. Although control is acceptable on the 
back side of the L/D curve, there is no reason to 
fly in this region. The only reason to fly slow is 
to stretch to the runway if low energy, and 
flying on the back side is not optimum for 
stretching. Minimum airspeed (max L/D), 
which is a function of weight and Mach, is 
about 190 to 220 KEAS. The minimum airspeed 
is available on the bottom line of the VERT SIT 
display; however, a better technique is to 
monitor maximum L/D alpha (diamond on the 
alpha tape). 


CAUTION 


On a TAL, the VERT SIT may give the 
lightweight minimum airspeed when the 


TAL weight is heavy. This is because there 
is only one set of OPS 3 VERT SITs and 
flight software is always set to the EOM 
weight. 


TAEM guidance will limit minimum airspeed. 
Unlike maximum airspeed, the gains for 
minimum airspeed are not set so low that the 
minimum airspeed will never be reached. 
TAEM guidance will very effectively fly 
maximum L/D if it needs to stretch to reach 
a runway. 
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WARNING 


TAEM guidance must have air data to 
perform airspeed limiting. If air data is not 


incorporated to TAEM (G&C on SPEC 50), 
the crew must fly pitch attitude limits 
(theta limits) to avoid violating airspeed 
limits. See section 7.4 for more details. 


Minimum airspeed is further limited by an 
uncontrollable pitch-up divergence. This pitch- 
up divergence always occurs at a slower speed 
than maximum L/D; however, at Mach 1.5 the 
limit is close to maximum L/D. The airspeed 
pitch-up divergence is not available onboard. 
Alpha must be monitored to avoid a pitch-up 
divergence. See section 4.4. 


400.0 т 
350.0 T 
300.0 
250.0 4 


200.0 4 


QBAR (psf) 


Maximum 
GN&C Limit 


150.0 — 


100.0 | 


50.0 


0.0 


28.0 24.0 20.0 16.0 


Structural limit 


Vrel (Kfps) 


Landing 


Maximum airspeed for lowering the gear is 312 
KEAS, based on landing gear structural limits. 


Maximum speed at landing is based on the 225 
knots ground speed (KGS) certified tire speed 
limit. To protect against this tire limit, the 
maximum predicted ground speed at the T/D 
evaluation velocity should not exceed 214 kt. 
Short field speed brake may be used to achieve 
the 11 kt pad. This pad was based on errors in 
the air data system, changing winds, and 
landing dispersions. Full 3 sigma protection 
does not always exist for this limit, nor does it 
exist for the minimum airspeed associated with 
the tailscrape. 


Minimum GN&C Limit 


12.0 6.0 4.0 0.0 


829.су5 


Entry Dynamic Pressure Envelope 


4, OPERATING LIMITATIONS 
4.3 Airspeed Limitations 


4.3-2 
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400 T 


Structural Limit 
зоо = 
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200 T 
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100 +GN&C Limit 


0.0 
8.0 7.0 6.0 5.0 


— M —— 


4.0 3.0 2.0 1.0 0.0 
Vrel (Kfps) 
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Minimum GN&C Limit 


830.cvs 


RTLS Dynamic Pressure Envelope 


Minimum airspeed at touchdown is limited by 
body flap scrape. This limit is protected by not 
landing slower than the targeted landing speed. 
For minimum airspeed, flight design protects 
for the crew landing 10 knots slow. The term 
"energy reserve" is often used to indicate the 
amount of time that the crew can delay 
touchdown and not scrape the body flap. See 
orbit landing speed restrictions chart. 


Derotation speed is limited by main gear 
loading for maximum speed and nose gear 
loading for minimum airspeed. The current 
technique is to derotate at 185 KGS using the 
beep trim on the RHC. Beep trim derotation 
may be delayed to no slower than 165 KEAS. 


Maximum airspeed for drag chute deploy is 230 
KEAS. Above this velocity, the drag chute 
shear pin will fail. This protects the orbiter 
from an inadvertent deploy on final. Minimum 
deploy speed is 80 KEAS. 


Nominal drag chute jettison speed is 60 KGS; 
however, the drag chute must be jettisoned by 40 
KGS to protect the main engine nozzle. If ground 
speed goes below 40 knots, the drag chute should 
not be jettisoned 
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Orbiter landing weight (1000 Ib) 
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OVEI = Orbiter vehicle end item. 


Orbiter Landing Speed Restrictions 
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44 АМОГЕ ОЕ АТТАСК 
LIMITATIONS 


CONTENTS 


Entry 


The maximum alpha for the orbiter during 
entry is designed to protect the TPS, maintain 
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The MEDS alpha tape displays the maximum 
L/D alpha as a magenta and black diamond for 
Mach <3.0. The tape also displays a green band 
denoting the maximum/ minimum alpha range 
for Mach 2.5. 


The Mach 1, 2, and 3 values are listed on the 
Entry Alpha cue card. The subsonic value is not 
listed in the FDF. 


The following tables from Flight Rule A4-207, 
Entry Limits, list the normal angle of attack 
limits for the orbiter during entry. 


control in the three axes, meet structural 
requirements during venting, ensure 
aerosurface hinge moments remain within SEI 
limits, and keep the orbiter within guidance TE 
limits. Consequently, the alpha limits may be 
well below the maximum/minimum usable P 30 
о 
alphas. 5 
с 
| 5. 20 
Тһе maximum L/D alphas for various Mach < << 
numbers are: 10 : 
0 [fue i cd cols fee 
3 17 на Mach Number 
otes: 
@ Flight control system design requirement 
2 15 (2) Спр dynamic 
1 12 (8) Venting, hinge moment 
(2) Guidance requirement 
Subsonic 10.5 825.cvs 
Orbiter Design Angle of Attack Limits 
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al profile 


Mach Number 


e Orbiter flies back side of power curve (increasing alpha implies 


increasing L/D) at Mach > 3.5 


e Orbiter flies front side of power curve at Mach < 3.5 
e Thermal or q-bar constraints prevent flying max L/D alphas until Mach 3 


826.cvs 


Orbiter Nominal Angle of Attack Profile 


44-1 
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4.5 SIDESLIP LIMITATIONS 


Numerous sideslip, В, limitations for the 
various ascent flight phases (SRB separation, ЕТ 
separation, aborts, etc.) are available in the 
Shuttle Performance Assessment Databook 
(SPAD). During the high dynamic pressure 
phase of the ascent, the maximum sideslip 
angle is also a function of angle of attack. 
Typically, the maximum В allowable ranges 
from +3° to +6°. 
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During entry, the maximum sideslip angle is 
+5°. Also during entry (2< Mach <12), the crew, 
by using the Roll Trim switch, will manually 
trim to reduce RCS jet firings if steady state 
sideslip exceeds 2°, one or more yaw jets fire 
continuously, or if scaled Ay (sensed lateral 
acceleration) exceeds the two-jet capability. 
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4.6 LANDING WEIGHT 
LIMITATIONS 


CONTENTS 


Maximum Landing Weight 


Maximum Landing Weight 


Landing weight limits are reduced for higher 
inclination flights because of orbiter thermal 
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restrictions. Any flight with a manifest that 
results in an intact abort or end of mission 
(EOM) landing weight greater than the certified 
limits must have a waiver specifying the limit 
for that flight. Approval of the waiver will be 
based on a case-by-case thermal analysis of the 
entry trajectory. 


The following table lists orbiter maximum 
landing weights for ascent aborts and EOM. 


Inclination 
Flight Phase 28.5° 39.0° 51.6° 57.0° 
RTLS 248k Ib 248k Ib 245k Ib 242k Ib 
TAL 248k Ib 248k Ib 244k Ib 241k Ib 
AOA/ ATO 248k Ib 248k Ib 242k Ib 239k Ib 
EOM 233k Ib 233k Ib 233k Ib 233k Ib 
Source: NSTS 07700, Vol. X, Book 1 
4.6-1 4. OPERATING LIMITATIONS 
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4.7 DESCENT RATE LIMITATIONS 


CONTENTS 


Main Gear Touchdown 
Nose Gear Touchdown. 


Main Gear Touchdown 


The orbiter was designed to withstand the loads 
developed from landing at the maximum sink 
rates shown in the following figure. The 
maximum allowable sink rate is a function of 
orbiter gross landing weight and crosswind. 
Crosswinds reduce the allowable sink rate. 


The type of payload returned in the payload 
bay also establishes the maximum allowable 
sink rate at main gear touchdown. The second 
graph shows the limit for crosswind and sink 
speed for the main gear for returnable and non- 
returnable payloads. 
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Еогмага 
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Cross wind = 0 knots 
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Cross wind = 20 knots 


200 210 220 230 240 250 260 
Gross Weights (KLBS) 


1 Maximum sink rate restricted to 8.4 fps 
for Xcg forward of 1076.7 inches 


832.cv5 


Source: NSTS 08934, SODB, Vol. V 
Main Gear Sink Rate 
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Landing Sink Rate vs. Crosswind Velocity 


Nose Gear Touchdown 


The maximum rate of descent at nose gear 
touchdown must not exceed 11.5 fps (9.9° per 
second) or the rate needed to prevent nose gear 
vertical loads in excess of 90,000 Ib. 
(Operational rates of descent average 5 fps.) 


(FT-LB) = (1172.3 - Xcg)*W/12 
= Weight in pounds 
Xcg in inches 


Pitch Rate (Deg/Sec) 


1.1 1.2 13 1.4 15 1.6 17 18 #19 2 
Mass Moment (MFT-LB) 
1090.су5 


Nose Gear Slapdown Pitch Rate Limit 


4. OPERATING LIMITATIONS 


4.7 Descent Rate Limitations 
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4. OPERATING LIMITATIONS 4.7-2 


4.7 Descent Rate Limitations 


4.8 СЕМТЕК ОЕ СКАУТТУ 
LIMITATIONS 


The orbiter X and Y c.g. limits are shown in the 
following figure. Mission planning for abort 
propellant dumps will ensure an adequate c.g. 
margin for intact aborts. Real-time mission 
management of orbiter consumables; i.e., cryo, 
propellant, water, will ensure the EOM c.g. is 
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within limits. This is most easily accomplished 
via the forward RCS propellant dump and OMS 
propellant wasting during the deorbit burn. 


The Z axis c.g. must be within the limits of 360.0 
to 384.0 inches at entry interface (approximately 
400,000 ft). 


6.0 


5.0 
4.0 


3.0 


2.0 


Contingency 
| Envelope | 


1.0 С (з) 


0 (5) Nominal 


(4) ‚ Envelope 
-1.0 HH —1- 


Yeg (inch) 


-2.0 


-3.0 


-4.0 


-5.0 


2 
© 


tes: 
Verified aero boundary. 
Design envelope aft limit. 


® [091098-67 15]. 


1070.0 1075.0 1080.0 1085.0 1090.0 1095.0 1100.0 1105.0 1110.0 1115.0 1120.0 1125.0 
Xeg (inch) 


(1) 
(2) 
(3) Forward limit for EOM, ATO, and AOA (X = 1075.2 inches). 

(4) Forward limit for GRTLS for angle of attack <30° and for TAL (X=1076.7 inches). 

(5) Forward limit for GRTLS for angle of attack >30° (X = 1079.0 inches). 

(6) Nominal cg envelope reflects а 1-inch uncertainty for Хед and a 0.5-inch uncertainty for У cg 


Source: Flight Rule A4.1.4-3 


4.8-1 


и5а007587 834.спу 


4. OPERATING LIMITATIONS 


4.8 Center of Gravity Limitations 
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4. OPERATING LIMITATIONS 4.8-2 


4.8 Center of Gravity Limitations 
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4.9 ACCELERATION LIMITATIONS For rolling maneuvers, the maximum normal 
load factor is reduced by approximately 1 


CONTENTS percent for every degree per second of roll rate, 
down to a maximum of Nz of 80 percent of the 
symmetrical load limit at 20 deg/sec roll rate. 
For example, at 5 deg/sec roll rate, the Nz 
maximum is 95 percent of the symmetrical load 
limit. 


Vn Diagrams 


Ascent 


The following Vn diagram demonstrates the 


The orbiter is constrained to the following acceleration limits in the TAEM region of entry. 


translational accelerations during ascent. 


Мх = | +3.11 2/-0.00 g 
Му = | +0.18 2/-018 g 
Ме = | +0.73 2/-0.06 g 


Епїту 


For orbiter Mach numbers less than 5.0 and 
weights less than, or equal to 211,000 Ib, the 
maximum symmetrical Nz is 25 g. The 
following graph shows the allowable Nz for Equivalent Airspeed (knots) 

various gross weights. Тһе negative 836.cvs 
acceleration limit is -1.0 g for Mach numbers 

less than 3.0 and is 0.0 g for Mach numbers 

greater than 3.0. 


1 УА 
0 50 100 150 200 250 300 350 400 


Limit Maneuver Load Factor, Nz (0) 
~ 


4.563 = (9.778х10:3 х W) 


Ы Max. Certified 
4 Min. Certified 


-1.823 + (3.90х107 x W) ~ 


180 190 200 210 220 230 240 250 260 
W, Landing Weight (КЊ) 


Orbiter Operational Maneuver Limits 
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4.9 Acceleration Limitations 
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4. OPERATING LIMITATIONS 4.9-2 


4.9 Acceleration Limitations 
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4.10 WEATHER LIMITATIONS 
Weather limitations for launch, abort landing, 
and end of mission landing are presented below 
(Ref. FR A2-6). 
Ceiling/Visibility (k ft)/(SM) Redundant Single-String No MLS 
MLS MLS 
KSC, EDW, Concrete Day 210/7 
МОК, АОА Night 28/5 NO-GO 
Daily PLS Lakebed Da died >10/7 
selection у required) 0 
(all sites) Night 215/7 МО-СО 
RTLS, TAL Concrete Day 25/4 RTLS 210/7 
Night 25/5 TAL NO-GO 
(WX recon 
required) 
ACLS/ECAL/ELS 0/0 28/5 
Predeorbit: One APU failed or 210/7 
attempt two APUs procedure 
Ceiling and Visibility Limits 
Surface Wind (Knots) Cross Head Tail Tail Gust Turb 
and Turbulence Peak Peak AVG Peak 
RTLS <15* <25 <10 <15 <10 <MOD 
Day EOM, TAL, AOA, <15 
daily PLS selection 
Night EOM, TAL, AOA, <12 
daily PLS selection 
Crosswind DTO 210 
«15 
Nominal drag chute deploy <15 
Landing > CDR FD19 <12 
Predeorbit: One APU failed or <10 <LGT 
attempt two APUs procedure 
ECAL/ELS <15 N/A 


*Requires an STA evaluation to 17 knots and a GO from the STA pilot. 


Surface Winds and Turbulence Limits 
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4. OPERATING LIMITATIONS 
4.10 Weather Limitations 
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produced by 
smoke/ fire up to 
1 hour after 
detaching 


approach path 


Rev. A 
Predeorbit 
: : (EOM : 
Thunderstorm, Lightning, and Prelaunch Daily PLS) Redesig ELS, ECAL, 
Precipitation Proximity Limits (RTLS, y Criteria ACLS 
@ mmi) TAL) Prelaunch 
MU (АОА) 
Radial from >20 >30 >15 
Tstorm (inclu- Dolus рше None at site 
ding attached E 
nontransparent Lateral along >10 >20 >5 
anvils) апа approach path 
lightning out to 30 n. mi. 
Vertical from top 22 
of cloud 
Radial from 215 220 215 
Detached center of prime N/A 
runway 
nontransparent 
anvil «3 hours Lateral along 25 >10 >5 
о14 approach path 
out to 30 n. mi. 
Vertical from top 22 
of cloud 
Radial from 220 230 215 
Precipitation confer oF prune N/A 
runway 
Lateral along >10 >20 >5 
approach path 
out to 30 n. mi. 
Vertical from top 22 
of cloud 
Cumulus clouds | Lateral along 20 N/A 


Thunderstorm, Lightning, and Precipitation 


4. OPERATING LIMITATIONS 
4.10 Weather Limitations 
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Shuttle Launch Wind Limits 


\ [ 
\ 34 34 34 / 


° 0/360° ° 
340° 350 010° өрөө 


330° | | 502 
t N \ | / / 


34 


х 
34 


—27 


837.cvs 


Launch Commit Constraint (60-ft winds at the pad) 
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4.10 Weather Limitations 
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4. OPERATING LIMITATIONS 4.10-4 
4.10 Weather Limitations 
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5. 


NORMAL PROCEDURES 
SUMMARY 


CONTENTS 


5.1 
5.2 
5.3 
5.4 
5.5 


PRELAUNCH 52e tette 51-1 
ASCENT. иена 52-1 
ORBIT eo abite tet 5.3-1 
ENTRY Ананы а нына ний 5.4-1 
POSTLANDING ................. eee 5.5-1 


5-1 


This section summarizes nominal procedures 
for a generic space shuttle mission. More 
detailed procedures may be found in the 
Astronaut Support Personnel Book, the various 
Flight Procedures Handbooks (FPH), and Flight 
Data File (FDF) documents. The FPH docu- 
ments also contain rationales for the various 
procedures listed herein. For flight-specific 
training, refer to the applicable FDF checklists/ 
cue cards. 


5. NORMAL PROCEDURES SUMMARY 
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5. NORMAL PROCEDURES SUMMARY 5-2 


5.1 PRELAUNCH 


CONTENTS 


Prelaunch Procedures 


Prelaunch Procedures 


Hr:Min (approx) 


L-33:00 


L-18:30 


L-16:30 


L-12:45 


L- 8:15 


L-5:35 


L-5:30 


Astronaut support personnel 
(ASP) conduct communications 
checks with the launch team. 
Caution and warning (C/W) 
volumes are adjusted so the air-to- 
ground communication can be 
heard over the C/W tone. UHF 
Guard is checked, and headset 
interface units (HIUs) are checked 
for proper operation, along with 
intercom (ICOM) loops A and B. 
If the ICOM recorder has been 
manifested, it is installed and 
tested. 


ASP ensures crew module has 
been vacuumed апа performs 
ascent switch list configuration. 


The backup ASP conducts a check 
of the middeck and flight deck 
and installs. certain cue cards, 
flipbooks, and checklists. 


The backup ASP adjusts CDR and 
PLT seats to the full down and aft 
position and then configures all 
seats for launch. Rotational hand 
controllers (RHCs) are adjusted, 
and SBTCs are set full forward. 


Pad is cleared for tanking. 


ASP reports panel ABORT light 
status when initiated by the Flight 
Director. 


ASP Checklist is initiated. Check- 
list includes communications 
check, potable/supply water 
quantity adjustment, LiOH cani- 
ster installation, air sample, pre- 
ingress switch reconfiguration, 


L-4:55 


L-4:25 


L-3:55 


L-3:45 


L-3:15 


L-2:45 


L-1:45 


L-2:00 


5.1-1 


USA007587 
Rev. A 


ECLSS Freon coolant loop “pay- 
load" heat exchanger flow veri- 


fication, navigation aids 
activation, and C/W memory 
clearing. 


Crew wakeup. 


Crew breakfast and photo oppor- 
tunity. 


CDR, PLT, MS2 get weather 
briefing. MS1/3 (PSs) don flight 
clothing and equipment. 


CDR, PLT, MS2 don flight clothing 
and equipment. 


Crew departs for the Pad. 


Crew arrives at the White Room; 
ASP verifies CDR and PLT 
launch/entry suit (LES)/flight 
equipment is properly configured 
before seat ingress, assists with 
ingress and installation of ascent 
FDF, monitors CDR/PLT commu- 
nication air-to-ground checks, 
assists with post-ingress switch 
reconfiguration, and coordinates 
the C/W and intercom volume 
adjustment; as the MSs ingress, 
the ASP verifies their LES/flight 
equipment configuration and 
assists ingress and communication 
hook up and checks. 


ASP verifies all non-flight equip- 
ment is removed from the crew 
compartment, terminates commu- 
nication with the Launch Control 
Center (LCC), and egresses. 


After the hatch is closed, a cabin 
leak check is performed. The cabin 
is pressurized to 16.7 psi and then 
vented to ambient when the check 
is complete over the next 48 
minutes. 


5. NORMAL PROCEDURES SUMMARY 


5.1 Prelaunch 
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L-1:22 


L-1:20 


L-1:15 


L-1:10 


L-1:00 


CDR prepares for the primary avi- 
onics software system (PASS)/ 
backup flight system (BFS) 
transfer. The LCC will perform 
the transfer via uplink. 


CDR places the OMS ENG 
switches to ARM/PRESS for GN2 
pressurization. The PLT takes the 
WSB GN2 supply to OPEN to 
provide N2 pressurization to the 
WSB. 


АП crewmembers conduct ап А/С 
voice check with MCC and receive 
updates to ascent/ abort data. 


Planned 10-minute launch hold at 
T-20 min 


PASS OPS 1 load is initiated and 
GNC FAULT is displayed on IDP 
1 while C/W is cleared. 


Min:Sec (approx) 


L-58:30 


L-57:00 


L-56:00 


L-49:00 


L-30:00 


L-25:00 


L-17:00 


T-9:00 


5. NORMAL PROCEDURES SUMMARY 


CDR transitions BFS to OPS 1. 


PLT conducts horizontal situation 
configuration for TAL sites and 
RTLS to KSC. When this activity 
is complete, the PLT configures for 
OMS interconnect with PASS and 
BFS. 


PLT performs the МР5 He 
reconfiguration by opening He 
and pneumatic isolation valves. 


Planned 40-minute launch hold at 
T-9 min. 


A ground-controlled fuel cell 
purge takes place about this time. 


The OMS/RCS crossfeed valves 
are configured for launch by the 
Launch Processing System. 


PLT clears the F7 C/W lights with 
the C/W MEM switch on C3. 


GO for launch given, and event 
timers started. 


5.1 Prelaunch 


T-8:00 


T-7:30 


T-6:15 


T-5:00 


T-3:25 


T-2:30 


T-2:00 


T-0:07 


T-0:03 


5.1-2 


PLT connects essential buses to the 
fuel cells. 


Access arm retracts. Crew makes 
final checks on seat positions, suit 
closures, and restraints. 


PLT performs APU prestart and 
verifies three gray "READY TO 
START"  talkbacks. IDP 1-3 
displays are GNC LAUNCH 
TRAJ, GNC SYS SUMM 1, AND 
BFS, SM SYS SUMM 2. IDP 4 
typically displays BFS SM SYS 
SUMM 2. 


Pilot starts APUs апа verifies 
normal pressure. CDR turns off 
flash evaporator feedline heaters. 


Main engine nozzles are gimbaled 
during the next 30 sec. The crew 
may feel the motion/ vibration. 


PLT clears the 
software. 


hardware and 


All crewmembers start O2 flow 
and close their visors. 


Ignition sequence for main 
engines begins. Crew monitors 
Pc’s increase. 


Crew monitors main engines, 
which should have Pc's above 90 
percent. 
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5.2 


CONTENTS 


ASCENT 


Powered Flight 


OMS Burns 


Powered Flight 


Min:Sec (approx) 


T-0:00 


SRB ignition, software transitions 
to MM 102, main engines at ~100 
percent Pc, and event timer counts 
up from zero. Throughout ascent 
phase, the crew monitors vehicle 
performance using DPS апа 
dedicated displays intervening as 
required/directed by MCC. The 
crew also uses the Flight 
Instruments, ADI,  No-Comm 
Ascent Abort Mode Boundaries, 
and Contingency Abort cue cards, 
to monitor the ascent trajectory 
and maintain awareness of abort 
options. Cue cards are used for 
malfunctions procedures. 


Typical displays used during 
ascent are PASS and BFS ASCENT 
TRAJ 1/2, PASS and BFS GNC SYS 
SUMM 1. BFS GNC SYS SUMM 2 
and BFS SM SYS SUMM 1/2 are 
used as required. 


Mission Elapsed Time (MET) 


Min:Sec (approx) 


0:01 


0:04 


0:07 


Ensure that FCS (pitch ага 
roll/ yaw) are still in Auto. If not, 
select Auto. Otherwise BFS 
Engage may be required for roll 
program at 0:07. 


If 104 percent is programmed for 
launch, at a velocity of 60 fps, the 
main engines are commanded to 
that level. 


At a velocity 2127 fps, the vehicle 
rolls, yaws, and pitches to the 


0:20 or 0:30 


(flight 
specific) 


2:00 


5.2-1 5. NORMAL PROCEDURES SUMMARY 


heads-down ascent attitude. 
Crew monitors and engages the 
BFS if maneuver not begun when 
required or not properly com- 
pleted. CDR/PLT select LVLH on 
ADI ATTITUDE switch. 


Crew monitors main engines’ 
throttling down to limit maximum 
flight dynamic pressure and to 
adjust for off-nominal perform- 
ance. Throttle level can vary, 
depending on flight design and 
SRB performance. 


Crew monitors main engines 
throttling back up to ~104 percent. 
Manual throttle may be selected if 
required. 


Maximum q-bar phase is passed. 
Control stick steering (CSS) may 
now be selected in lieu of BFS 
Engage if PASS guidance is not 
nominal. 


ASCENT TRAJ display will 
indicate PC <50 when both SRB 
Pc's drop below 50 psi. SRB 
separation should occur shortly 
thereafter (no later than MET 
2:20). During SRB separation, all 
three upfiring jets in the forward 
RCS fire to protect the cockpit 
windows from SRB debris (Forward 
Window Protect). When the SRBs 
are separated, GNC changes to 
MM 103. BFS commands flash 
evaporator system (FES) on via 
payload buses. 


Post-SRB separation, the crew 
checks that PASS and BFS 
TMECOs converge to expected 
values to verify performance of 
Ascent Guidance. 


5.2 Ascent 
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OMS Assist 


MM 103 
transition + 
10 seconds 


Roll to 
Heads Up 
(RTHU) 


5. NORMAL PROCEDURES SUMMARY 


5.2 Ascent 


An OMS assist burn during 
nominal ascent тау Бе 
manifested on some performance- 
critical missions. А 400045 OMS 
assist burn takes about 1:42 to 
complete and provides а 250-Ib 
performance gain. For OMS assist 
flights, SPEC 51 will display the 
manual dump quantity and timer 
until the OMS assist initiates. 
Then, the OMS assist information 
will be displayed. For а 4000-Ib 
OMS assist, SPEC 51 will display 
15% for the Item 9 quantity and 
1:42 for the initial dump time to 
go (OMS DUMP TTG). The crew 
should verify the OMS assist by 
monitoring the OMS Pc on the 
OMS/MPS display and OMS 
quantity. When the OMS assist 
completes, TTG should display 0. 
For OMS assist missions, if an 
ATO abort is selected pre-MECO, 
the Item 9 quantity will reflect the 
calculated ATO abort dump 
quantity plus the OMS assist 
quantity. However, TTG will 
reflect any amount of OMS assist 
completed. In other words, if the 
OMS assist completed, ТТС 
would only reflect the ATO dump 
because the dump time during the 
OMS assist has already been 
decremented. 


Crew verifies the flash evaporator 
is working properly (T « 60? F and 
decreasing on EVAP OUT T 
overhead meter). 


28.5? inclination RTHU at 
VI = 13.6 К (Vrel 12,200 fps) 


39.0? inclination RTHU at 
VI = 13.4 К (Vrel 12,200 fps) 


51.6? inclination RTHU at 
УГ- 13.2 K (Vrel 12,200 fps) 


K (Vrel 12,200 fps) 


7:30 


~8:25 


5.2-2 


Beginning with 515-87, ап RTHU 
is performed during nominal 
ascent to allow an early handup 
from MILA to TDRS east in 
anticipation that the Bermuda 
ground station will close. The I- 
loaded RTHU relative velocity of 
12,200 fps is converted to inertial 
velocity for use in the checklist 
because this is the cue card 
available onboard. The roll man- 
euver is performed at 5 deg/sec 
and is accompanied by a pitch 
attitude change of 20° to 30° as the 
vehicle rolls about the X-body 
axis, changing the thrust vector 
direction. 


S-band PM communications 15 | 
reconfigured from STDN-HI to 
TDRS mode via a stored program 
command in the BFS GPC. 


Main engine cutoff (MECO) 
occurs. Crew cues are that the 
main engine Pe on the OMS/MPS 
display drop to zero, the MAIN 
ENGINE STATUS lights illumi- 
nate red, and the cutoff bug on the 
PASS and BFS ASCENT TRAJ 2 
indicates MECO velocity. MECO 
time may vary, depending on 
flight profile, but should match | 
simulation time. 


Post МЕСО 


OMS Burns 
SI 


The MECO velocity should be 
approximately 25,820 fps. The 
crew verifies ORBITAL DAP 
lights illuminated, indicating 
MECO confirmed. The crew also 
verifies external tank (ЕТ) 
separation (MAIN | ENGINE 
STATUS lights extinguish). If ET 
separation is inhibited, the crew 
must null rate(s) (if >0.7°/sec). If 
rates are null and the ET SEP 
inhibit remains, the crew must 
assume а feedline disconnect 
failure. The ascent checklist will 
cleanly direct this operation. 
Meanwhile, а -2 translation 
occurs and GNC transitions to 
MM 104 at completion of this -Z 
translation. At MM 104 plus 2 
seconds (if a prescribed HA has 
been achieved), the crew will 
translate in the plus X direction 
for a prescribed length of time to 
assist external tank photography. 


Once in MM 104, the crew refers 
to the Ascent Pocket Checklist for 
malfunction procedures. The 
crew verifies OMS 1/2 targeting, 
using current orbit HA and HP 
displayed on GNC OMS 1 MNVR 
EXEC, to determine if an OMS 1 
burn is required. 


For a nominal MECO (OMS 1 not 
required), the crew proceeds to 
the POST OMS 1 tab in the Ascent 
Pocket Checklist. From there, 
FDF assists the crew in stepping 
through procedures required 
during the transition from 
powered flight to the OMS 2 Burn. 
Required steps during this time- 
frame include the ET PHOTO 
MANEUVER and powered flight 
systems management steps, all of 
which are orchestrated in the 
Ascent Pocket Checklist. 


OMS 1 targets appear on GNC 
OMS 1 MNVR EXEC displays. 
The burn is executed for SI OMS 1 


5.2-3 


МЕСО 
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and available for DI OMS 1 if re- 
quired due to a large underspeed. 
The OMS 1 Burn cue card and the 
OMS 1 Burn Monitor cue card are 
referenced for normal OMS 1 burn 
procedures and malfunctions that 
occur during the burn. 


Crew selects INRTL on ADI 
ATTITUDE switch and begins the 
automatic maneuver to burn atti- 
tude if OMS 1 burn is required. 
When in the proper attitude, the 
error needles should be centered 
and ADI inertial attitude should 
match burn attitude on the MNVR 
display. VGOs should be cross- 
checked for proper burn attitude 
and guidance. 


Min:Sec (approx) 


+1:45 


+2:00 


DI or SI 
Post OMS 1 


EXEC key must be pressed on 
CDR/PLT keyboard within 15 sec 
of OMS TIG to enable burn. 


IDP 1 in GNC OMS 1 MNVR 
EXEC, IDP 2 in SYS SUMM 1, and 
IDP 3 BFS, GNC SYS SUMM 2. 


OMS 1 ignition. Crew monitors 
burn (OMS Pc ~100 percent, en- 
gine control valves -100 percent, 
He pressure decreasing slowly, 
engine inlet pressure drops to 
—200 psi, OMS quantity decreases 
715 sec after ignition, delta VIOT 
decrementing nominally) апа 
prepares to respond in case of an 
off-nominal burn; burn duration 
-2:30. Two seconds after end of 
burn, the CDR places the OMS 
ENG switches to OFF and trims 
out any delta V residuals in the X 
and Z directions using the THC. 


If DI (or if OMS 1 is MECO +6 
min or more), the MPS propellant 
dump is automatically initiated at 
MECO +2 min. 


The crew performs the tasks in the 
Post OMS 1 procedures section of 
the Ascent Checklist. CDR and 


5. NORMAL PROCEDURES SUMMARY 


5.2 Ascent 
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PLT turn FLT CNTLR POWER 
switches (2) OFF to prevent 
inadvertent inputs to the RHCs 
(which can initiate manual DAP). 


NOTE 


Taking FLT CNTLR POWER switches to 
ON or OFF may cause the DAP to 
downmode from Auto to Manual. Power 
surges in the system can be confused with 
an RHC input, causing the DAP to 
downmode. 


MET 


Min:Sec (approx) 


12:55 


5. NORMAL PROCEDURES SUMMARY 


5.2 Ascent 


PLT verifies the BODY FLAP 
pushbutton light is out (light 
extinguishes at the end of a 
timer). During that time, the MPS 
dump should have completed 
(72:00 duration). The hydraulic 
МР5/ТУС isolation valves are 
closed, and APU shutdown is then 
performed after checking with 
MCC. 


CDR takes the FES Primary 
Controller to ON from the GPC 
position and reenables the FES 
feedline heaters prior to the OPS 2 
transition and securing BFS. PLT 
takes the cryo O2 tank 1 and 2 B 
heaters to AUTO. 


М51 takes the APU tank, fuel line, 
and Н20 line heaters to "A" auto 
for freeze protection. 


PLT sets the AC BUS SNSR 
switches to the AUTO TRIP posi- 
tion. They were in MONITOR 
during ascent to prevent SSME 
loss due to inadvertent bus trip. 


CDR/PLT modes GPCs to MM 
105 for the OMS 2 burn. 


CDR/PLT loads OMS 2 targets as 
required and OMS gimbal trim 
data (OMS 1 trim remains until 
changed. Gimbals do not move 
until 15 sec before burn); OMS 


ET centerline 


targets verified (PASS and BFS). 


PLT secures MPS engine power 
and performs GH2 inerting. 


PLT 
doors. 


closes the ET umbilical 


CAUTION 


latches must be stowed prior to 


door closure to prevent door drive mechanism 


damage. GH2 
umbilical closure because the GH2 is vented into the 
ET door cavity. 


OMS 2 Burn 
TIG 


inerting must be done prior to ET 


PLT prepares OMS for the burn 
by verifying proper valve con- 
figurations. 


CDR, PLT set ADI ATTITUDE to 
INRTL position and maneuver to 
the burn attitude. 


Min:Sec (approx) 


-5:00 


TIG 


Crew transitions to OMS 2 Burn 
and Burn Monitor cue cards for 
procedural reference. 


CDR, PLT make final verification 
of burn attitude, engine selection, 
DAP selection, OMS gimbal trim, 
He PRESS/VAP ISOL valve 
positions, and activate their FLT 
CNTLR POWER. 


Min:Sec (approx) 


-2:00 


-0:15 


5.2-4 


CDR/PLT set OMS ENG switches 
to ARM/PRESS and verify the 
engine press valves are open. 


CDR/PLT initiates EXEC 
command to perform burn. There 
is no need for the crew to correct 
attitude errors prior to OMS 2 
ignition because OMS engine 
thrust vector control (TVC) will 
fly the vehicle to the proper 


attitude. OMS ТУС can be used 
to take out attitude errors up to 
the maximum error limit for OMS 
ignition to occur. (Limit 15 
variable as а function of 
remaining AV and attitude error; 
however, an attitude error 2909 
guarantees ignition cutoff.) 


00:30-00:60 CDR, PLT monitor OMS 2 burn, 


(00:42 Pc's (~100 percent), delta УТОТ 
nominal and time to go (TGO) decreasing, 
for DI) bipropellant valves (100 percent), 


and perigee increasing. Crew 
prepares to complete burn with 
single engine or RCS if failures 
occur. Burn duration is ~2 min 
for 160 n. mi. circular orbit (based 
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Post Insertion 


The Post Insertion Checklist is used for nominal 


procedures. 
Malfunction 
malfunctions. 


The Orbit Pocket Checklist and 
Book ате references Юг 
During post insertion the 


following activities must be accomplished to 
prepare for on-orbit operations: 


Reconfigure to on-orbit software and 
GPC configuration. 


Activate radiators. 
Open payload bay doors. 


Рой and stow LES, reconfigure 
cockpit for orbit operations. 


on nominal ascent). MET 

OMS 2 Cutoff Day/Hr:Min (approx) 

*2 sec CDR/PLT secure OMS engines (2 0/0:55 CDR/PLT reconfigure the GPCs. 
sec delay for purge) and trim all Guidance, Navigation, апа 
axes residuals «2 fps («0.2 fps for Control On-orbit software (GNC 
orbit critical burns). OPS 2) is loaded into GPCs 1 and 

2. Systems management (SM) 

Post OMS2 The crew returns to the Ascent software is loaded into GPC 4. 
Post OMS 2 section of the Ascent СМС OPS 2 data are loaded into 
Checklist for nominal procedures GPC 3 and "freeze dried" (taken 
and the Ascent Pocket Checklist off line to preserve an independ- 
for malfunctions. CDR/PLT ent source of data) while GPC 5 
secure FLT CNTLR POWER and retains BFS software but is placed 
verify the DAP is in AUTO. in HALT. With SM software 

loaded, uplink control for S-band 
CDR performs an OMS TVC and TDRSS is given to the SM 
gimbal check (secondary then computer. Because only three 
primary checks are conducted to IDPs can be assigned to the 
verify operations prior to on-orbit PASS, IDP 3 is de-assigned, and 
use). IDP 4 (powered up during MS aft 
flight deck configuration) 15 
PLT reconfigures OMS and RCS assigned to 4. Pulse-code 
valves for on-orbit operations. modulation master unit 
(PCMMU) formats are loaded for 
CDR/PLT change to MM 106. on-orbit high and low data rate 
Crew stows ascent related FDF telemetry. Displays are called up 
and unstows the Post Insertion as required, but the crew must be 
Checklist, | Orbit ^ Operations careful to avoid assigning all 
Checklist and Pocket Checklist, three IDPs to the same СРС; e.g., 
cue cards, and the orbiter do not use all three IDPs for SM. 
Malfunction Book. 
Mission/ payload specialists 
egress seats during this period. 
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MSs perform the following the main engines are secured, 
functions on the middeck: and the display driver units 
(DDUs) cb's for the aft flight 

e Install UV filter on hatch controllers апа displays аге 
window. closed. 

e  Repressurize water supply МЕТ 
tank A and activate the : 
airlock heaters. Rey asp pe) 

“и goatee 0/1:00 ње ш. апа ue the 
headsets and microphones BR Ss support 

P у computers (PGSCs). 

° Configure middeck audio — 0/1:05 PLT  configures the payload 
distribution unit (ADU) and electrical buses on the flight deck 
speaker box. (payload dependent) while other 

. buses are powered via the middeck 

e Stow ascent FDF in "return panels. 
to Houston" bags and 
unstow on-orbit FDF. 0/1:08 Crew configures and activates 

the galley and waste containment 

e Close appropriate circuit system (WCS). 
breakers. 

0/1:10 Flight deck audio is reconfigured 

These activities тау Ре from headsets to speaker and 

accomplished piecemeal during handheld mic operations. 

the next hour. 

0/1:12 PLT executes ап automatic 
0/0:59 An MS begins flight deck maneuver to the PLBD opening 

configuration to include: open attitude -ZLV with a flight- 
cabin vent and cabin vent specific bias. This is a time 
isolation cb’s (to preclude critical action; DAP A/AUTO/ALT 
accidental venting), activate the are selected. 
OMS and RCS heaters, which will | | 
keep them at 55° to 90° Е 0/1:18 CDR activates the radiators by 
(A-heater in AUTOMATIC, placing both the RADIATOR 
B-heater OFF), and activate APU BYPASS VALVE MODE 
lube oil heaters. Although the and RADIATOR CONTROLLER 
APU раз generator Бей LOOP 1 and 2 switches (two 
temperatures will remain warm each) to AUTO, AUTO А, СОК 
until about MET 6:00, a caution is then takes the Freon RAD IATOR 
included at this point to monitor ISOLATION МОРЕ switch to 
the APU fuel pump outlet and AUTO. It takes 90 seconds for the 
bypass line temperatures and radiator startup sequence. 

к E Вэ? gen/ Ai 0/1:20 An MS sets up the aft panel 

2. i NN: PAYLOAD BAY FLOOD switches 

flight deck communication : А à 
: А : . as required (given possible 

configuration is accomplished, up e 

ap : payload limitations) for PLBD 

S-band communication is opening. Lights require ~3 min 

Рона ве sar ШЭВЭЭ at the bigh for full bright). If the CCTV is to 

rate, R15 cb's are closed as cM 
: be used for PLBD opening, it will 

required, ascent thrust vector b | г 

: А | е activated at this time. 
control, engine interface units, 
and master event controllers for 
5. NORMAL PROCEDURES SUMMARY 5.2-6 
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0/1:28 


0/1:36 


0/1:37 


0/1:45 


0/1:52 


0/1:56 


М52 initiates automatic PLBD 
opening with the SM PL BAY 
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GNC UNIV PTG display. 


DOORS display and switches on 0/1:57 An MS opens the supply Н20 
panel R13L. Centerline latches dump isolation valve to ensure 
take ~20 sec, forward and aft redundant dump path, and then 
bulkhead latches take ~30 sec, configures other tank valves as 
and each door (starboard then needed for mission requirements 
port) opens in ~63 sec. After the (water transfer, etc.). 
doors are open and power . . 
removed from them, display SM 0/2:02 MS on the middeck configures 
ANTENNA is usually selected the airlock for ingress. Ductwork 
for IDP 4 when other displays are and booster fans are set up to 
not required. The MCC will provide air flow into the airlock. 
upins лан шашип ШӨНӨ. оов PLT activates the APU steam 
updates (TMBU) as required. 
vent heaters to remove any 
If there are no known problems possible ice formation on the 
with the major orbiter systems, the water spray boiler (WSB) vent 
MCC will issue a GO for orbit openmgs: 
operations. Ku-band antenna is MET 
deployed (~23 sec) and activated. 
Ku-band signal strength is shown _ Day/Hr:Min (approx) 
on the SM OPS 201 Antenna 
display and panel A1U meter. 0/0:2:05 М5/Р5 seats are removed and 
stowed. 
CDR, PLT egress seats; all crew 
doff and stow launch/entry suits 0/2:10 After go for vernier operations 
(LES). During this time, the MCC from MCC, CDR verifies use of 
uplinks the orbiter state vector vernier jets is safe (radiators 
and RCS quantity compensations. operating and FES hi-load off) 
and activates verniers on MCC 
The crew installs the quick-don call. DAP selection is typically 
masks (QDMs) into the various A/AUTO/VERN. 
О2 quick disconnects now that 
the LES are no longer used. 0/2:12 Crew configures controls for on- 
orbit operations by using panel 
CDR selects the SM 88 diagrams in the Post Insertion 
APU/ENVIRON THERM dis- Checklist that depict switch 
play, and if Freon loops are positions. 
operating nominally аз they 
should by this point (Freon loop 0/2:21 PLT performs the hydraulic 
radiator out temp <60° F), secures thermal conditioning enable steps 
the flash evaporator and turns in the Orbit Operations Checklist, 
the high load evaporator off. which allows the GPCs to operate 
hydraulic circulation pumps 
The CDR powers on the star when pressures or temperatures 
trackers and both star tracker are below set limits. 
doors are opened (6 to 12 sec.). 
CDR selects GNC 22 5 TRK/ Note: Payload electrical con- 
COAS  CNTL display and straints may alter this activity. 
activates the star trackers. SPEC 
21 is then called up to initiate the 
calculations for the IMU delta 
angles, and then returned to 
5.2-7 5. NORMAL PROCEDURES SUMMARY 


5.2 Ascent 


USA007587 


Rev. A 

0/ 2:24 MS resets C/W system from 
ascent to on-orbit operations. 
Limits for some systems are 
changed while others аге 
inhibited. 

0/2:29 Fuel cell performance is plotted 
using the FUEL CELL VI 
PERFORMANCE PLOT. 
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5.3 ORBIT 
CONTENTS 


Orbit Operations 


OMS (RCS) Burns 
Rendezvous 


Orbit Operations 


This section summarizes typical orbit 
operations for METs 0/2:30 through 0/22:00. 
Activities occurring after 0/6:30 аге 
representative of subsequent flight days until 
the last full on-orbit day. 


Note: Actual activities and times will vary 
from mission to mission. 

D/H:M (approx) 

0/2:30 Crew completes post insertion 
activity. Post Insertion Checklist 
is stowed, and crew refers to the 
Flight Plan for nominal activities. 
FD1 EZ activities are begun; i.e., 
lamp test, smoke detection 
circuit test, pressure control 
system (PCS) setup, Compound 
Specific Analyzer - Combustion 
Products (CSA-CP) ops, and 
orbiter cabin air cleaner (OCAC) 
filter cleaning. The Photo/TV 
Checklist is  unstowed, апа 
camera assembly is Берип. 
Other equipment required for 
flight day (FD) 1 activities is 
unstowed апа set up. The 
assembly power converter units 
(APCUS) are activated, if needed. 


0/ 2:35 If the remote manipulator system 
(RMS) is flown, initial activation 
procedures begin at about this 
time. RMS AC cb's are closed, 
power 15 applied to the 
manipulator controller interface 
unit, RMS shoulder brace is 
released, heaters are activated, 
and, if required by payload 
operations or constraints, the arm 
is deployed. 


5.3-1 


0/2:45 


0/3:10 


0/3:45 


0/3:50 


0/4:00 


(various 
times) 


0/8:00 
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IMU alignment (S TRK) using 
Star Data is accomplished. GNC 
UNIVERSAL POINTING, GNC 
21 IMU ALIGN, and GNC 22 
S TRK/COAS CNTL displays аге 
used for this activity. 


Aft controller checkout initiated 
in each axis with the output 
verified on the GNC 25 RM 
ORBIT display. 


APU steam vent heaters аге 
secured (initiated at MET 2 hr). 
APU gas generator and fuel 
pump heaters (A) are placed in 
AUTO at panel A12 to keep the 
generator bed 360? to 425? F and 
the fuel pump 80? to 95? F (the B 
heaters are used mid-mission to 
exercise the redundant system). 


CRYO О2 tank heater sensor 
check is accomplished to verify 
short circuit protection for the O2 
tank heaters (SM 68 CRYO 
SYSTEM display). 


Unless there is an FD1 deploy or 
other mission-specific 
requirement, the first on-orbit 
meal is prepared and eaten at this 
time. 


Crew begins payload activities. 
These activities may include 
payload deploy, Spacehab 
activation, or secondary experi- 
ment activation, depending on 
the type of mission. 


Presleep activities begin 3 hr 
(2:15 for dual-shift operations) 
before the sleep period (can be 
shortened to 2 hr for single shift 
and 1:30 for dual-shift operations 
if required). Presleep activities 
on the flight deck include: 


® Configure cryo heaters and 
manifold valves as directed by 
MCC. 
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e Install O2 bleed orifice. Note: 
This may be done postsleep, 
depending on РРО2 levels. 


e Update SM checkpoints. 


e Set CRT timer for crew wake 
up and C/W alert tone 
duration. 


e Adjust the cabin temperature 
control as required. 


e Configure active PCS O2/N2 
controller to OPEN to avoid 
nuisance "FLOW" alarms 
while sleeping (147 config 
only). 


• Power down unnecessary 
electrical equipment (IDPs, TV 
power, TV cameras, VTR, 
cabin and PLB lights, DDUs). 


e Install window shades/ filters. 


• Remove power from primary 
reaction jet drivers (8) to 
preclude primary jet ON 
failures. 


е Maneuver to sleep attitude. 
Minor payload or experiment 


related activity can be scheduled 
during the presleep, if required. 


Presleep activities on the middeck include: 


е Food preparation and cleanup 
for the evening meal. 


e CO2 absorber (ШОН) replace- 
ment (one of two canisters is 
replaced). 


e General housekeeping and 
WCS cleaning. 


e Set up next дау equipment 
(if practical). 


e Write/record mission notes. 
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0/9:50 


0/11:00 


0/19:00 


e Configure | communications 
panels and lighting. 


APU gas generator and fuel 
pump heaters (A) are activated 
at panel А12 along with the APU 
tank/fuel line/H2O system (A) 
heaters (3) (B heaters off). 


Sleep period is scheduled to 
begin no later than 16 hr after the 
crew’s launch day wakeup (4:55 
prior to launch) but can be 
extended up to 2 hr if unex- 
pected launch holds occur. The 
sleep period is scheduled for 8 hr 
but can be shortened to 6 hr if 
required. 


The postsleep period begins 
about 8 hr after the start of the 
sleep period and extends for 3 hr 
for single-shift operations (1:30 
for dual shift) but may be 
shortened to 2 hr (1:15 dual shift) 
if required. 


Middeck postsleep activities include: 


e Reconfigure lighting and com- 
munications panels. 


• Replace CO2 absorber (one of 
two canisters is replaced). 


е Install O2 bleed orifice (first 
postsleep) to increase O2 to 
the middeck, if not installed 
presleep. 


e Prepare meals and clean up. 


• General housekeeping. 


Postsleep flight deck activities include: 
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е Reconfigure lighting, window 
shades, communications 
panels and instruments, and 
the SM Alert tone duration. 


• Power on IDPs (3). 


0/22:00 


е Adjust cabin temperature (if 
required). 


е Reonfigure active PCS О2/ М2 
controller back to AUTO. 


e Configure OMS/RCS inter- 
connect as required to pre- 
serve aft RCS propellant. 


е Power primary RJD drivers 
(8) ON. 


® Configure cryo heater/mani- 
fold valves per MCC instruct- 
tions. 


The crew begins a full workday 
on orbit with their flight-specific 
activities. Each day, photo/TV 
scenes are activated per the 
P/TV Checklist. Normally, the 
crew downlinks live TV of flight 
deck or middeck activities once 
each day. At a minimum, a VIR 
dump of crew activities is down- 
linked. When the PLB cameras 
are not required for flight require- 
ments, MCC occasionally asks to 
control the cameras and conduct 
Earth viewing. MCC will not 
activate cabin cameras without 
prior crew coordination. Once 
during a 4-day mission (twice for 
longer flights) the avionics filters 
are cleaned. Also, the operating 
humidity separator is checked for 
water accumulation about every 
12 hours during the first few on- 
orbit days. Once each flight day 
(the morning of likely/scheduled 
EVAs and entry day), each 
crewmember has an opportunity 
to communicate privately with a 
flight surgeon during a private 
medical conference (PMC). 


1/00:00 


1/01:00 


1/5:00 


3/00:00 


4/00:00 
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Manually purge fuel cells (FD 1 
only to save ground turn-around 
time). Use SM 69 FUEL CELLS 
display to monitor purge. All 
other purges will be uplinked 
from MCC. 


The day prior to docking, the 
crew performs а series of 
procedures to intialize, verify, 
and configure the docking 
system. When the procedures are 
complete, the system is powered 
back down. 


PLT runs the Fuel Cell 
Monitoring System (FCMS), a 
PGSC program that monitors the 
health of the fuel cells to a level 
of detail that Mission Control 
cannot see. The data is collected 
into a text file and downlinked 
for analysis. 


Conduct supply and/or waste 
water dump, monitored using 
SM 66 ENVIRONMENT display 
(purges and dumps are по 
accomplished during star tracker 
use due to possible 
contamination). The dumps 
make room for new water that is 
being produced. 


Mid-mission, the crew will 
reconfigure various systems for 
even usage, including heaters 
(water, hydraulic, etc.) from A to 
B, PCS from 1 to 2, and cabin 
temperature controller from 1 to 
2. 
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OMS (RCS) Burns 


OMS/RCS burns are used on orbit to raise or 
lower the orbital altitude, for rendezvous 
phasing, and deorbit. The burn may be done 
with one or both OMS engines or the RCS, 
depending on the delta V required. Propellant 
for the burn can come from either OMS pod or 
the RCS system. OMS BURN cue cards (OMS- 
2/ORBIT OMS BURNS (2) and OMS BURN 
MONITOR (2)) are installed on the forward 
panels for the burn. On-orbit burns require OPS 
202 (302 for entry) with GNC ORBIT MNVR 
EXEC and GNC SYS SUMM 2 displays. 
Procedures for on-orbit OMS/RCS burns are 
similar to those discussed in the OMS 2 section. 
Burn target data is normally uplinked by MCC 
and loaded automatically. If delta V total >6 fps, 


Flight-specific 
located in the Rendezvous Checklist. The phase 


elapsed time (PET) below is referenced to target 


Rendezvous 
This section summarizes the major events that 
occur during the final phases of a rendezvous. 

are 


rendezvous procedures 


PET is used to track 


intercept (Ti) TIG. 
rendezvous events and normally is displayed 


on the DPS display. Actual times will vary, 


depending on flight profile. 
NH Burn (not shown) - NH is a ground- 
This burn is 


targeted height adjust burn. 
accommodated in the checklist, if necessary on 


the day of rendezvous. (This burn may be 
executed prior to the day of rendezvous). 
NC Burns - The NC burns are phasing 
maneuvers used to initiate or modify the 
rendezvous approach (closing rate). They are 


ground-targeted burns, the last of which is 
designed to place the orbiter 8 n. mi. behind the 


an OMS burn will be required. If delta V total is 
target (Ti point) in one (or two) revs. 


24 and «6 fps, a *X RCS burn is used (thereby 
limiting the amount of forward RCS burned). If 


the delta V total «4 fps, the burn is multi-axis 


(КС5) with no maneuver to burn attitude. 


20 


FGB AT CENTER OF 


ROTATING LVLH 
REFERENCE FRAME 


30 


ххэ S ТЕК 


ин NIGHT 
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-250 kft 


z 
[e] 


PET EVENT 
-3:00 START RNDZ T/L (not shown) 
-2:22 NH BURN (not shown) 


-1:32 NC BURN 
-1:28 S TRK NAVIGATION 


-0:58 NCC BURN 
-0:44 RADAR NAVIGATION 


-0:00 Ti BURN 
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Ж 
А 
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Orbit Rendezvous Profile 
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EVENT 


ISS AT CENTER OF 
ROTATING LVLH 
REFERENCE FRAME 
хэхэх S ТАК 
-—— NIGHT 


15 
kft 


Ti BURN 

RR NAV (OR S TRK NAV, IF REQD) 
MC1 BURN 

SUNSET 

OOP NULL BURN 

MC2 BURN 

Rbar : SUNRISE 


MC3 BURN X 


МСА BURN, START MANUAL PHASE 


1094: 


Orbit Post Ti Profile 


Star Tracker NAV - After the final NC burn, 
the crew maneuvers the orbiter to a -Z (-Y) 
target track attitude, which will point the 
desired Star Tracker (ST) at the target to 
provide relative navigation data. The ST angle 
data will be used to improve the onboard filter 
(FLTR) state vector. 


NCC Burn - This is the first onboard targeted 
burn. It uses the filter state vector updated by 
the star tracker data. This is a corrective 
combination burn that will try to create a node 
at and correct the transfer to the Ti point, 1200 
feet below and 48,600 feet (8 n. mi.) behind the 
target. 


Radar NAV - The rendezvous radar is expected 
to lock on at a range of approximately 150 kft. 
The radar provides range and range rate data, 
in addition to the angle data. The FLTR vector 
with the ST data is saved to the propagated 
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vector (FLTR to PROP transfer) prior to taking 
the Radar data to nav. This will protect the 
vector with the star tracker data from possible 
problems with the radar data. 


Ti Burn - The Ti burn initiates the final 
(transition) phase of rendezvous. It is targeted 
onboard using the updated FLTR vector. Ti is 
primarily a posigrade phasing burn designed to 
place the orbiter at the MC4 position (900 feet 
behind and 1800 feet below the target). 
Targeting to MC4 has been shown to reduce the 
dispersions at MC4 and, therefore, reduce the 
dispersions at manual takeover. 


RADAR/S TRK NAV - During this portion of 
the profile, the orbiter will be in a -Z (-Y) target 
track attitude. NAV will be updated with radar 
or ST data. This data will be used to target the 
four midcourse correction burns and perform 
the out-of-plane null. 
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+VBAR(FT) 


EARTH 
ISS-Centered LVLH Frame 


EVENT 
MANUAL PHASE TAKEOVER (POST MC4) 
2000 FT BRAKING GATE (Rdot = -3.0 fps) 
1500 FT BRAKING GATE (Rdot = -2.3 fps) 


1000 FT BRAKING GATE (Rdot = -1.5 fps) 
SWITCH ТО LOWZ 


600 FT BRAKING GATE (Rdot - -0.8 fps) 
RBAR ARRIVAL 


|5 | os | ARRIVE АТ 170 ЕТ STATIONKEEPING 
| | os | RE-ESTABLISH APPROACH 


STATIONKEEPING AT 30 FT 
| | 1:16 | RE-ESTABLISH APPROACH 
|7 | "= | ooo | ||| хас 


Orbit Terminal Phase апа К-Баг Approach 
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1 0:00 MANUAL PHASE TAKEOVER (POST-MC4) 
2000 FT RANGE RATE GATE (RDOT = -3.0 FPS) 
0:02 1700FT RANGE RATE GATE (RDOT = -2.6 FPS) 
2 0:03 1500 FT RANGE RATE GATE (RDOT = -2.3 FPS) 
Е 0:08 1000 FT RANGE RATE GATE (RDOT = -1.5 FPS) 
TRANSITION TO LOWZ 
4 0:13 600ҒТ (КООТ = -0.8 FPS) 
BEGIN TORVA, PERFORM DAP A +X PULSES AS REQ'D 
TO NULL TARGET MOTION (APPROX. 22 PULSES) 
15 0:25 320ЕТ (INT-TO-INT) VBAR ARRIVAL (АООТ = -0.2 FPS) 
0:41 110FT (RDOT = -0.15 FPS) 
0:45 75FT TRANSITION TO NORMZ, 
CONFIGURE FOR SINGLE -X JET (DESELECT F1F/F2F) 
6 0:53 30FT STATIONKEEP FOR 5 MINUTES IF REQUIRED 
7 1:04 DOCKING 


Orbit Terminal Phase and V-bar Approach 
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MC1 Burn - The МС1 burn will trim any 
dispersions left over from the Ti burn, taking 
advantage of more sensor data. MC1 targets to 
the MC4 position. 


Planar Null - The next task is to monitor the 
GNC 33 REL NAV display closely to watch for 
the point when the out-of-plane distance 
between the two orbits (Y) becomes zero (nodal 
crossing). The NODE time on SPEC 33 will give 
the crew an estimate of when this will occur. At 
this point, the crew will null the rate (Y-DOT), 
which will put the orbiter in the same orbital 
plane as the target. 


MC2 Burn - This is a special burn because it is 
based upon the elevation angle to the target, not 
on а time. The burn ТІС can change so the burn 
will occur at the desired elevation angle. The 
MC2 burn sets up the standard trajectory and 
reduces the dispersions at MC3. MC3 and MC4 
Burns - The MC3 burn also targets to MC4 and, 
typically, is just a "trim burn" similar to МСТ. 


The МСА burn targets to 600 feet on the +R-bar. 
This burn should "coast" the orbiter to the 
desired range on the *R-bar. In the nominal 
case, MC4 will be mostly a non-zero *X burn. 


Manual Phase - Post-MC4, the orbiter is on a 
coasting trajectory to the 600-foot point on the 
+R-bar. Ап attitude maneuver will be 
performed to put the orbiter in the +R-bar 
attitude by the time it reaches the R-bar. 
R-dot corrections (braking gates) will be 
performed. 


Flight-Specific Final Approaches - (Covered in 
detail during Prox Ops lessons) 


R-bar: Fly up the +R-bar from the 600-foot 
point. 


TORRA: Fly to the +R-bar until 600 feet, 
then transition to the -R-bar at twice orbit 
rate. 


TORVA: Fly to the *R-bar until 600 feet, 
then transition to the *V-bar at twice orbit 
rate. 


INERTIAL: Orbiter maintains inertial atti- 
tude hold during final approach to target. 
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NOTE 


For a more detailed overview of 
rendezvous, see the “RNDZ CONCEPTS" 
computer based training lesson. 


Last Full On-Orbit Day 


The last full on orbit day includes nominal 
flight day activities plus general cabin stowage, 
FCS checkout, RCS hot fire, and those unique 
procedures that must be accomplished prior to 
transition to the Deorbit Prep Checklist (-04:00 
TIG). Before presleep activities, the crew con- 
ducts entry planning and stows the Ku-band 
antenna. 


Presleep and postsleep activities are nominal, 
with the exception of the continuation of 
general cabin stowage. Additionally, fluid 
loading preparation (four 8 oz containers per 
person) and cabin air samples may be 
accomplished in the postsleep period or deorbit 
preparation. Тһе flight control system 15 
checked for proper entry operation (also saves 
ground test time). The test (conducted in two 
parts) is accomplished with an APU (MCC 
designated), but may be done with a circulation 
pump, if required. 


FCS Checkout, Part 1 


FCS checkout Part 1 consists of the following 
activities: 


• Power on FCS sensors and controls prior 
to the transition to OPS 8. Aerosurface 
amplifiers (ASAs) must be ON prior to 
GNC OPS 8 if an APU is used and OFF 
if a circulation pump is used. 


® Event timer is set to count up (to track 
APU ON time). 


е Hydraulic thermal conditioning 18 
terminated and the APU is prepared for 
operation. 


e ON МСС GO, the selected APU is 
brought on line in low pressure and 
event timer is started. 


5.3-8 


e If APU operation is nominal, normal 
pressure 18 selected for actuator 
checkout (SM 87 HYD THERMAL 
display). 


• Proper elevon switching valve operation 
should be noted. 


e Surface drive is initiated (some surfaces 
may not drive properly right away due 
to cold hydraulic fluid). Test should be 
complete in about 30 sec. 


e A secondary actuator check is initiated 
to test the bypass feature of the 
actuators. When the test is complete, 
the APU is shut down and hydraulic 
thermal conditioning is re-enabled (if 
required). Expect a marked structural 
vibration when ports pop during the 
secondary actuator check. 


FCS Checkout, Part 2 


Part 2 of the FCS checkout begins with a sensor 
test (GNC 40 SENSOR TEST). The orbiter is 
placed in free drift. The crew then initiates the 
sensor tests (accelerometer assemblies (AAs), 
microwave landing system (MLS), Tactical Air 
Navigation (TACAN), radar altimeter, rate gyro 
assemblies (RGA), and air data transducer 
assemblies (ADTA)). Sensors failing the test will 
be deselected for entry. 
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Following the sensor test, the FCS mode/ 
channel switch test is conducted. These proce- 
dures verify FCS switch contacts and all entry- 
critical switches (flight controller power 
required). Next a test of the nose wheel steering 
system is performed. The next series of proce- 
dures verify proper operation of controllers and 
their associated switches (left and right). 
Finally the DDUs and head-up displays (HUDs) 
are tested and adjusted for entry. When the 
FCS checkout is complete, the DPS is returned 
to GNC OPS 2 (G8 to G2 transition), and all 
entry equipment is secured. 


RCS Hot Fire 


This test is conducted to verify the operation of 
seldom used RCS jets (thereby decreasing 
ground turnaround time). Manual DAP is 
selected and the orbiter is verified/placed in 
free drift. Each RCS jet is tested (GNC 23 RCS 
display) and the results noted (3 sec delay 
between pulses to allow time for a fault 
message and 30 sec delay if a failure is 
annunciated). When the Hot Fire test is 
complete, the vehicle is placed in inertial hold to 
allow damping of rates before returning to the 
required attitude. RJDs, DDUs, and MDMs are 
then secured as required. 
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Deorbit Preparation 


TIG 
Hr:Min (approx) 


-4:00 Тһе crew transitions to the Deorbit 
Prep Checklist for nominal 
procedures. PLT sets CRT timer for 
deorbit TIG using the GNC 2 TIME 
display and SM timer. 


-3:56 CDR initiates radiator coldsoak by 
placing RAD CNTLR OUT TEMP 
switch to the HI position and 
activating topping FES to minimize 
propulsive venting. Vehicle 15 
maneuvered to "tail sun" attitude (-Х 
SI) for the coldsoak. The Н20 Loop 
Bypass controllers are checked out 
and the H2O loops are configured for 
entry. 


-3:50 MSs continue entry stowage along 
with entry airlock configuration. 


-3:48 Ku-band antenna is stowed (if not 
already accomplished in last presleep 
period). 


-3:45 Radiators are stowed (if deployed). 


-342 Compute М2 quantity (for entry cabin 
leaks) and identify depleted H2 tanks 
(for burn cards). 


-3:35 Specialists install seats and FDF 
containers. 


-3:30 
to 
-2:30 


-3:27 


-3:25 


-3:15 


-3:10 


-2:55 


-2:51 


-2:40 
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MS performs payload  deacti- 
vation/entry preparation іп this 
timeframe, as required. 


DPS is configured for  deorbit 
preparation. The BFS is woken up to 
ensure it has interface to the forward 
IDPs. 


PLT activates APU water boiler steam 
vent heaters (at least 2 hr before APU 
start) and terminates hyd thermal 
conditioning. PLT prepares Юг 
hydraulic repressurization of the main 
engine thrust vector controls (engine 
bells must be properly stowed to 
prevent thermal damage). 


CDR, PLT power up FCS, DDUs and 
navigation aids for entry (RGAs and 
ASAs must be on prior to OPS 3 
transition). 


Crew begins Entry Switch List 
verification by comparing crew 
compartment switch positions with 
diagrams in the Deorbit Prep book. 


CDR initiates radiator bypass to retain 
Freon  coldsoak. Alternate FES 
controllers are checked out to save 
ground test time. PLBDs will not be 
closed until this checkout and until 
Freon temperatures are down to 39° F. 
Primary RCS jets are used because FES 
Hi Load vent forces are too strong for 
vernier jets. H2O crossover valve is 
verified open to allow all water tanks to 
feed the FES equally. 


MS prepares for PLBD closing: PLB 
lights activated (as required), 
cameras/ video recorder readied, RMS 
TV camera positioned and RMS 
heaters secured (if RMS flown). 


Crew closes PLBDs using SM PL BAY 
DOORS display on IDP 4 (SM OPS 2). 
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TIG 

Hr:Min (approx) 

-2:25 MS performs  post-PLBD closing 


-2:23 


--2:16 


-1:58 


-1:55 


procedures, which include securing 
PLB lights, deactivating/stowing 
cameras, and taping down foot 
restraints (to prevent tripping during 
egress). 


CDR monitors auto maneuver to 
attitude suitable for S-band 
communications if required. Crew 
may go to deorbit attitude, depending 
on flight profile and TDRS position. 


CDR, PLT configure DPS (three 
phases) to place GPCs 1, 2, 3, and 4 in 
PASS OPS 3 and GPC 5 in BFS OPS 3. 
Prior to OPS 3 transition, entry TFLs 
are loaded and SM Checkpoint Initiate 
is performed to update the FDA in 
case a wave-off is required. Once in 
OPS 3, the crew refers to the Entry 
Pocket Checklist for malfunction 
procedures. 


MS deactivates star tracker and closes 
doors. 


CDR, PLT, MSs perform entry switch 
list configuration and verification at 
this time. The following items will be 
performed or verified: 


Forward Flight Deck 


e Electrical power to brakes, brake 
heaters, anti-skid, and nose wheel 
steering (NWS) is applied. 


e Verniers are secured. 


e FES control is given to the BFS. 
Freon loop RADIATOR ISO- 
LATION MODE switch is taken to 
OFF. Cb's for HUM SEP and IMU 
FAN signal  conditioners аге 
opened. 


е One О2/1М2 valve is opened in case 
of a cabin leak. 


5. NORMAL PROCEDURES SUMMARY 
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-1:42 


-1:40 


-1:39 


-124 


5.4-2 


® Communications panels are 
configured to provide maximum 
redundancy. 


Aft Flight Deck 


e Secure hydraulic heaters. 
е Set up DTV for entry. 


e Connect an LES communications 
cable (dC Utility Power MN C). 


е Open Ku-band circuit breakers. 
Middeck 


® Configure communications panel 
for entry. 


e Pressure control system (PCS) is 
configured for N2 water tank ullage 
pressure. 


е Close 14.7 cabin regulators (protects 
№2 if leak occurs) 


® Close O2 regulators (so O2 flow 
goes only to LES). 


e Remove and stow bleed orifice. 


CDR receives MCC readup of PADs 
(OMS propellant PAD, deorbit/ 
entry/land PAD, апа deorbit 
maneuver PAD). The current state 
vector, and deorbit targets are also 
uplinked. Crew can use PGSC (SPOC) 
to determine targets and cg. if 
required. 


MS enables MPS helium 
pressure C/W (assists crew іп 
isolating failed open regulator). 
Hydraulic system C/W parameters for 
low pressure are activated (alarm will 
sound immediately since APUs are 
OFF). 


system 


Crew conducts entry review as 


required (15 min alloted). 


CDR, PLT don LESs. 


ТІС 

Hr:Min (approx) 

-1:10 Specialists don LESs. 

-1:06 Final IMU alignment is performed by 
CDR to reset RM threshold prior to 
deorbit burn. This maximizes IMU 
RM, two-level attitude failure 
detection. 

-1:04 Crew begins fluid loading (containers 
filled іп  postsleep). This helps 
prevent orthostatic intolerance upon 
exposure to gravity. 

-0:59 СОК, PLT ingress seats. 

-0:57 CDR, PLT remove HUD covers. 

-0:53 Crew performs LES pressure integrity 
check. 

-0:50 Crew doffs and stows  on-orbit 
communications headsets. 

-0:33 MS deactivates WCS and galley. 


Deorbit Burn 


-1:03 


-0:55 


-0:47 


-0:46 


-0:40 


АП begin fluid loading per individual 
prescription. 


CDR, PLT perform LES pressure 
integrity check. 


CDR, PLT stow all unnecessary FDF 
items and transition to the Entry 
Checklist for the nominal procedures. 


CDR, PLT receive final  deorbit 
update/uplink. Deorbit flight rules are 
verified with MCC. Exact time may 
vary. 


CDR performs OMS TVC gimbal check 
(during AOS), using OMS MNVR 
EXEC display. 


PLT initiates APU pre-start procedures 
(during AOS). BFS, SM SYS SUMM 2 is 
used to check APU status. 


-0:25 


-0:15 


-0:05 
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CDR, PLT conduct horizontal situation 
configuration using GNC 50 HORIZ 
SIT; BFS GNC 50 HORIZ SIT; and GNC 
51 OVERRIDE for both PASS and BFS. 


PLT initiates OMS burn preparation, 
which includes checking engine trims 
and placing OMS and RCS valve 
switches in the pre-burn configuration. 


MS3 removes and stows side hatch UV 
filter, locking device, and Pyro Box 
Safing pin. 


PLT performs vent door closure with 
the GNC 51 OVERRIDE display. 


CDR, PLT receive final  deorbit 
update/uplink if required. М51 and 
М52 ingress their seats. 


CDR proceeds to OPS 302 and 
GO/NO-GO is given for deorbit burn. 


CDR initiates maneuver to deorbit burn 
attitude on OMS MNVR EXEC display. 
CDR, PLT verify ADI switches in 
proper positions. MS places ОМ5/ КС5 
heater switches in proper configuration 
for entry. 


PLT performs single APU start. One 
APU must be operating in low pressure 
prior to the burn. First APU start pro- 
cedures vary, depending on weather. 
CDR verifies orbiter is in the deorbit 
burn attitude +5°. The crew transitions 
to the Deorbit Burn cue card for 
nominal procedures, and the Burn 
Monitor cue card for malfunction 
procedures. The Deorbit Burn Flight 
Rules cue card should be consulted 
prior to executing the burn. 


Deorbit Burn 


TIG 


Min:Sec (approx) 


-5:00 


5.4-3 


Once on {һе Deorbit Burn cue cards, 
CDR and PLT ensure OMS He 
switches, ADI switches, and FLT 
CNTRL PWR are in the proper burn 
configuration. 
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-2:00 


-0:15 


0:00 


CDR takes OMS ENG switches to 
ARM/PRESS in preparation for the 
burn. 


CDR hits EXEC key to trigger OMS 
ignition. 


Deorbit burn TIG. CDR, PLT monitor 
the burn using delta УТОТ, VGO, TGO, 
and Hp from GNC OMS ММУК EXEC. 
BFS GNC SYS SUMM 2 display is used 
for OMS systems data. Section 7 
discusses deorbit burn monitoring and 
downmoding. 


As burn termination nears (TGO going 
to 0), crew monitors current perigee 
(HP) approaching targeted HP and 
delta УТОТ approaching 0. Deorbit 
OMS burn time varies with orbital 
altitude. Typical burn times are 2-3 
minutes. During the burn, the Deorbit 
Burn Monitor cue card is used for 
malfunction procedures. 


OMS Cutoff 


+2 
sec 


If nominal burn, CDR secures OMS 
engines following the automatic purge 
and trims residual X and Z velocities (<2 
fps for steep targets and -0.5 fps for 
shallow ones). The crew returns to the 
Entry Checklist Post Deorbit Burn 
section for nominal procedures and to 
the Entry Pocket Checklist for 
malfunction procedures. 


PLT performs OMS/RCS 
reconfiguration by verifying the proper 
position of RCS switches and closing 
OMS HE and crossfeed valves; MS stows 
PGSC (SPOC). 


CDR proceeds to OPS 303, verifies the 
proper attitude, and initiates maneuver 
to the EI -5 min attitude. CDR also 
conducts OMS gimbal powerdown 
verifying after gimbals have driven to 
the proper entry position. 
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EI 


Min:Sec (approx) 


-20:00 


-18:00 


-13:00 


-11:00 


-6:00 


5.4-4 


СОК starts а secondary actuator 
check, if not already done during FCS 
checkout and time allows, using GNC 
53 CONTROLS, BFS SM SYS SUMM 2, 
and GNC DEORB MNVR COAST 
displays. 


PLT performs forward RCS dump 
with GNC 23 RCS, GNC DEORB 
MNVR COAST, and GNC SYS SUMM 
2 displays. Dump times for various 
forward RCS quantities are listed in 
the Entry Checklist. It takes 90 
seconds to dump 50 percent forward 
RCS with 4 jets (twice as long using a 
2 jet dump). 


The forward КС5 is always dumped 
unless needed for c.g. control. This 
reduces the hazard to the crew if a 
hard landing is made. 


СОК, PLT perform entry switch 
checks (using GNC 51 OVERRIDE) 
and exercise brake pedals. 


PLT starts remaining two APUs, 
verifies nominal performance, then 
switches all three APUs to normal 
pressure in preparation for the SSME 
hydraulic repress. 


PLT performs main engine hydraulic 
system repressurization to ensure the 
nozzles are properly stowed. 


If required, PLT initiates hydraulic 
fluid conditioning on MCC's call and 
monitors surface position indicators 
for aerosurface cycling. 


Crew makes burn report to MCC and 
updates new state vector if required. 
All crew members inflate anti-g suits if 
desired. 


Тһе crew transitions to the Entry 
Maneuver cue card for nominal entry 
procedures. 


-5:00 


-3:00 


CDR transitions GPCs to OPS 304 
when verified at EI-5 attitude. Crew 
switches to AESP for malfunction 
procedures. 


Program test inputs (PTIs) are enabled 
on SPEC 50 when applicable. 


PLT verifies FWD RCS MANIFOLD 
ISOLATION valve switches (4) are 
closed (unless forward RCS PTIs are 
scheduled). 


Entry Interface 


+ = Time from EI 
- = Time to touchdown 
Min:Sec (approx) 


+0:00 
-32:14 


+2:39 
-29:35 


43:32 
-28:42 


34:45 
-27:29 


+5:00 
27:14 


+5:18 
-26:56 


Orbiter reaches EI (400,000 ft) at an 
Earth relative velocity (V) of ~24,600 
fps and descent rate (H-dot) of ~500 
fps. The crew compares ADI, AMI, 
and AVVI data to Entry cue card 
data. ENTRY TRAJ (1 - 5), HORIZ 
SIT, and GNC SYS SUMM 1 displays 
are monitored. The BFS ENTRY 
TRAJ display is available to compare 
PASS and BFS guidance. The PLT 
can call up BFS SYS SUMM displays 
as desired to check system operation. 


Automatic elevon trim begins at a 
q-bar = 0.5 psf. 


Aerosurface control begins at q-bar = 
2.0 psf. CDR, PLT monitor elevon 
and aileron deflection angles on 
surface position indicator. 


Closed loop guidance initiated (CLG 
Init) at q-bar = ~8 psf or drag = ~3 
fps; Guidance box appears on 
ENTRY TRAJ to indicate closed loop 
guidance. 


Roll RCS jets deactivated at q-bar = 10 
psf. 


First non-zero bank command issued 
by guidance at H-dot -240 ft/sec 
(CLG Init plus 15 to 30 sec). 
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+6:10 Maximum surface X temperature 
-26:04 region begins (Mach 24 to 19). Actual 
drag should be within .5 fps? of 
orbiter bug drag. 

+8:04 Pitch RCS jets deactivated at q-bar = 

-24:10 40. 

+11:49 At drag = 11 fps’, drag Н updates 

-20:25 begin in NAV filter. Crew monitors 
data on GNC 50 HORIZ SIT display. 

+13:40 First roll reversal is issued by 

-18:34 guidance when azimuth error (delta 
AZ) = 41059. Occurs at a flight- 
specific velocity between 23,000 and 
6,200 fps, depending on crossrange. 

Note: 1k fps = Mach 1.0 

+14:42 Тһе PLT checks that the 

-17:32 MPS TVC isolation valves 

Ма = 19 k fps are closed. Pitch and roll 

(Mach = 19) RCS activity lights аге 

Alt = 215 k ft reconfigured when q-bar = 

50 psf to indicate RCS 
saturation. 

+15:51 PASS апа ВЕБ  TRAJ 

-16:23 displays mode to ENTRY 

Ма=17 К fps ТКА) 2. 

(Mach = 17) 

Alt = 200 k ft 

+17:00 NAVAID power is verified 

-15:14 and I/O RESET performed. 


VREL =15 k fps 


This ensures NAVAIDs will 


(Mach = 15) warm up before they are 
Alt = 185 k ft required (in case they were 
off due to a powerdown). 

+17:57 PASS апа BFS ENTRY TRAJ 
-14:17 mode to ENTRY TRAJ 3. 
Ма=14 К fps Drag is up to 33 fps? and Gs 
(Mach = 14) up to 1.5. 
Alt = 182 k ft 
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+18:57 

-13:17 

Уве =12 К fps 
(Mach = 12) 
Alt = 176 k ft 


*19:20 

-12:54 
VreL=10.5 К fps 
(Mach = 10.5) 
Alt = 167 k ft 


+20:03 

-12:11 

Уре =10 К fps 
(Масһ = 10) 
Alt = 150 k ft 


+21:00 

-11:14 

Увс- 8.0 К fps 
(Mach = 8) 


+21:34 
-10:40 
Vin=7.5 К fps 
(Mach = 7.5) 
Alt = 144 k ft 


+22:00 
-10:14 

Vin=7 К fps 
(Mach = 7) 
Alt = 138 k ft 


+22:41 

-09:33 

Ма=6 К fps 
(Mach = 6) 
Alt = 131 kft 


Radiator coldsoak usage is 
initiated in preparation for 
the FES becoming inactive: 
Radiator bypass valves (2) 
are placed in automatic and 
radiator controller loops (2) 


are put in AUTO B(A). 

CDR and PLT Беріп 
monitoring for aileron 
saturation. 


PASS and BFS ENTRY TRAJ 
mode to ENTRY TRAJ 4. 
Alpha and drag start to 
ramp down, but Gs stay up 
over 1.3. 
Speedbrake opens to 81 
percent. 


SSME repositioning for drag 
chute deploy. If GPC 
annunciates SSME REPOS 
FAIL, drag chute is emer- 
gency deploy only. 


MCC has sufficient tracking 
for state vector update. This 
time can vary depending on 
ground track and tracking 
station performance. 


MCC and the crew compare 
TACAN data to МАУ. Е 
acceptable, MCC tells the 
crew to take TACAN. GNC 
50 HORIZ SIT display is 
used to check TACAN 
errors and accept TACAN 
data for use by the NAV 
filter. 


PASS and BFS ENTRY TRAJ 
displays mode to GNC 
ENTRY TRAJ 5. 
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*23:30 
-08:44 

Ма = 5 k fps 
(Mach = 5) 
Alt = 120 k ft 


+25:00 
-07:14 
(Mach = 3.4) 
Alt = 95 k ft 


+25:30 
-06:44 
(Mach = 2.6) 
Alt = 83 k ft 


Air ааа probes аге 
deployed. CDR, PLT begin 
aileron and rudder trim 
monitoring. The crew can 
check for good probe deploy 
discretes by noting the 
absence of OFF flags on the 
AMI and AVVI tapes when 
the AIR DATA select switch 
is taken from NAV to LEFT 
then RIGHT. This does not 
apply if the BFS is engaged. 
The BFS does not support 
OFF flags. Air data 
information will not be valid 
until Mach is «3.5. 


Using GNC 51 OVRD, GNC 
50 HORIZ SIT, and 
instrument tapes the crew 
checks air data is close to 
NAV. MCC will give a GO 
to take air data to NAV 
and/or G&C using Items 25 
and 28 on GNC 50 HORIZ 
SIT. 


PLT ensures APUs operating 
in the best ^ possible 
configuration for landing based 
on апу previous failures. 
CDR, PLT activate HUDs. 


Terminal Area Energy Management 


(TAEM) 


+25:40 
-06:34 
(Mach = 2.5) 


Alt = 81 k ft 


+25:55 
-06:19 
(Mach = 2.4) 
Alt = 80 k ft 


5.4-6 


ууате 


PLT verifies аш data incorpo- 
rated into guidance. If not, 
the CDR must take CSS con- 
trol to avoid a transient when 
air data is incorporated. Soft- 
transitions automati- 
cally to OPS 305. Guidance 
enters TAEM phase. VERT 
SIT 1 displays replace PASS 
and BFS ENTRY TRAJ dis- 


plays. 


Forward, aft, and midbody 
compartment vents open. 


+26:50 
-05:24 
(Масһ = 2.0) 
Alt = 75 k ft 


Air data must be 
incorporated to Guidance and 
Control or the crew must stay 
within theta limits as shown 
on the ADI or on the VERT 
SIT display. 


WARNING 


If low energy, or flying a big heading 
alignment cone (HAC) (>~325°) and 
air data is not incorporated, ТАЕМ 


guidance 
uncontrollable pitch up between 
Mach 1.0 and 1.5. The CDR will fly 
pitch CSS at M <2.0 and monitor 
theta limits. 


+27:53 
-04:21 
(Масһ = 1.0) 
Alt = 54 k ft 


+2817 
-03:57 

(Масһ = 0.9) 
Alt = 46 k ft 


+29:00 
-03:14 
(Mach = 0.7) 
Alt = 32 k ft 


will command. an 


RCS yaw jets are deactivated. 


CDR selects pitch, roll, and 
yaw (R/Y) CSS. Speedbrake 
“commanded” versus “actual” 
position is verified. Speed 
brake is now controlling 
energy. PLT flight controller 
is verified ON. This switch 
must be on for NWS to work. 
NWS is verified in system 1. 


РЕГ verifies landing gear 
extend isolation valve is open 
(occurs at M=0.8). PASS and 
BFS  VERT SIT displays 
transition to VERT SIT 2. PLT 
and CDR monitor PASS and 
BFS GNC 50 HORIZ SIT for 
HAC acquisition. The glide 
slope indicator (GSI) is now 
accurate enough to use. 


5.4-7 


USA007587 


Rev. A 
+30:00 MS2 monitors MLS acquisi- 
-02:14 tion. All residuals and ratios 
280 KEAS disappear from PASS GNC 50 
Alt = 15 k ft HORIZ SIT upon MLS acquisi- 

tion and an overbright MLS 
will appear in the middle right 
of the display. CDR and PLT 
check PAPIs and НО 
overlays on runway to evalu- 
ate МАУ state. — De-clutter 
HUDs as required. Crew 
starts landing comm protocol. 

Approach and Landing 

*31:00 

-1:14 

300 КЕА5 (18° апа 20° OGS) 

Alt = 12 k ft CDR and PLT monitor outer 
glide slope (OGS) and verify 
with the PAPIs. At 10,000 ft 
crew verifies Approach and 
Landing guidance (flashing 
A/L on VERT SIT display), 
body flap to TRAIL, and LES 
visors down (KSC). 

+31:24 PLT compares radar ALT 1 

-0:50 vs. 2. 

300 KEAS 

Alt =5k ft 

+31:35 MS2 checks speed brake 

-0:39 command percent (actual will 

300 KEAS lag). 

Alt =3k ft 

31:41 CDR initiates preflare and 

-0:33 begins transition onto Бай 

300 KEAS bar. PLT arms landing gear 

Alt = 2k ft on call from CDR. 

+31:51 Shuttle will be lined up оп 

-00:23 ball bar. MS2 checks speed 

297 KEAS brake command percent 

Alt = 500 ft (second smart speed brake 
reset). 

+31:54 PLT deploys the landing gear 

-0:20 on call from CDR. PLT/MS2 

288 KEAS check gear indications down. 

Alt = 300 ft 

5. NORMAL PROCEDURES SUMMARY 
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+32:04 

-0:10 

261 КЕА5 
Alt = 30-80 ft 


+3214 
-00:00 
195 ог 205 
KEAS 


+32:15 
+00:01 
195 КЕА5 


+32:16 
+00:02 
185 КЕА5 


+32:24 
+00:10 
145 {о 155 
KEAS 


Final flare begins. 


Main gear touchdown (195 
KEAS GW «220,000 Ib). CDR 
controls drift with rudder, 
maintains wings level with 
RHC. PLT and MS check 
speed brake opening. PLT 
checks HUD display for 
WOW lock on (WOWLON) 
(HUD reconfigures and air- 
speed moves to upper left 
corner of the display). Also, 
the velocity vector disap- 
pears. 


PLT deploys drag chute on 
call from CDR. 195 KEAS. 


CDR initiates Беер trim 
derotation, which targets 1.5 
deg/sec. 


Nose gear touchdown (HUD 
reconfigures with а "С" show- 
ing up by the groundspeed). 
MS2 selects SRB SEP to 
AUTO/MAN or ET SEP to 
MAN and depresses the cor- 
responding pushbutton to 
backup automatic discretes 
for elevon load relief, NWS, 
and anti-skid circuitry. CDR 
maintains or slowly and judi- 
ciously corrects to centerline 
with NWS. Мб checks elev- 
ons down (makes sure they 
have load relief) and NWS 
FAIL and anti-skid fail lights 
off. MS calls "NWS FAIL" as 
necessary. (If no load relief, 
RHC full forward. If NWS 
FAIL light comes on, steer 
with rudder, RHC, and 
brakes. NWS2 may be avail- 
able.) 
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5.4. Entry 


+32:34 
+00:20 


+32:46 
+00:32 
60 KGS 
(#20 kts) 


+32:50 
00:36 
40 KGS 


+32:56 
+00:42 
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CDR checks ground speed 
and decel on HUD. Post 
midfield, CDR applies brakes 
at 140 knots ground speed 
(KGS) or 5000 feet runway 
remaining, whichever occurs 
first. If 140 KGS is reached 
first, nominal braking profile 
is used This deceleration 
profile is typically 8 to 10 
ft/sec’. Ағ 5000 feet of 
runway remaining, if ground- 
speed is greater than 140 
knots, CDR applies maximum 
braking. 


PLT jettisons drag chute on 
CDR call. 


CDR reduces braking to less 
than 6 ft/sec? until wheelstop. 


Orbiter stops; CDR reports 
“wheels stop” to MCC. Crew 
transitions to Post Landing 
Procedures in the Entry 
Checklist. At wheel stop, 
speed brake is closed. 


5.5 


POSTLANDING 


CDR takes NWS, flight controller power, 
and HUD power off. PLT checks that APU 
auto shutdown is enabled and speed select 
is in norm. PLT takes HUD power off. 


CDR and PLT safe RCS/OMS, and 
deactivate air data probe heaters. 


CDR, PLT, and MS safe the drag chute and 
landing gear. 


PLT, after notifying MCC, opens the ET 
umbilical doors. PLT initiates hydraulic 
load test on MCC call. 


CDR performs DPS transition to GNC OPS 
901 on MCC call. 


CDR performs the radiator reconfig and 
activates the NH3 boiler, as required (MCC 
call or C/W). Typically, this is done out of 
order from the rest of the postlanding 
procedures based on cooling requirements and 
frequently is done very early in the post- 
landing time frame. 


PLT sets body flap to trail and performs 
main engine reposition with PASS OPS 9 
display GNC 105 TCS CONTROL. PLT 
also performs APU/HYD shutdown after 
main engine repositioning is complete. 


CDR performs PCS deactivation. With a 
GO for extended powerup from MCC, 
CDR/PLT begin system deactivation. 
CDR secures GPCs 2-4 reassigning strings 
to 
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GPC 1 and informs MS to proceed with MS 
System Deactivation Procedures (LRU and 
APU heater deactivation, RCS/OMS 
heaters turned OFF). 


PLT performs vent door purge positioning 
and RCS/OMS valve test. 


Convoy personnel open hatch. 


Flight Surgeon enters cabin for health 
check. ASP, suit tech, and Shuttle Process- 
ing Contract Spacecraft Operator (SPC 
SCO) enter the cabin to assist with egress 
and removal of experiments and early 
return items. 


CDR, MS, (PS) egress seats. MS, PS 


retrieve "return to Houston bags." 


CDR, PLT, MS, (PS) egress orbiter to begin 
postlanding activities. After medical 
evaluations, showers, visits with family 
and postlanding medical data collection, 
the crew returns to Houston. Normal 
return to Houston occurs 6 to 9 hours after 
landing. 


ASP removes special FDF but retains some 
entry related FDF until handover to KSC. 


ASP hands vehicle over to SPC SCO when 
MCC (Houston flight) hands off to Orbiter 
Test Conductor (OTC). 
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6. EMERGENCY PROCEDURES 


CONTENTS 


LAUNCH ABORT MODES 


CONTIN 
SYSTEMS FAILURES 
MULTIPLE FAILURE 
SCENARIOS 

SWITCH AND PANEL 
CAUTIONS 

SYSTEMS FAILURE 
SUMMARY 


This section covers critical failures to which the 
crew must react expeditiously. Both perform- 
ance-related and system failures are presented. 
Critical system failures are those requiring a 
response within 5 minutes to safe the system or 
restore its function. Performance-related fail- 
ures may result in an abort, depending upon 
the severity. Launch and ascent aborts are 
discussed in detail. 


The emergency procedures in this section are 
designed to be general in nature and not flight 
specific. Detailed procedures are available in 
Flight Data File (FDF) checklists. It is very 
important that crewmembers learn to recognize 
failures and react properly. Failure identifica- 
tion is the key. Only through study, training, 
and practice will a crewmember achieve the 
desired degree of proficiency prior to flight. 


In some areas, actual crew operations are 
described, along with monitoring and control 
devices. This is particularly important for aborts, 
where dynamic flight cues, instruments, and cue 
cards must be rapidly interpreted. Some abort 
rationale is also included to ensure the 
crewmember understands various abort modes. 


The key to most emergencies is to utilize all 
information available, including inputs from 
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the Launch Control Center (LCC) while on the 
pad and postlanding, and from the Mission 
Control Center (MCC) during all flight phases. 
Both the LCC and MCC have an enormous 
amount of data at their disposal. With the 
highly trained Launch Team and Flight Team 
working together with the crew, most 
emergencies can be quickly identified and 
proper actions started. 


There are three levels of protection to prevent 
loss of a shuttle because of failures: component 
failure prevention, vehicle design, and training. 


Component failure prevention is accomplished 
through a stringent process of equipment 
design, qualification tests, maintenance, check- 
out, quality control, and proper operation. 


The shuttle is designed to a “fail-ops/ fail-safe” 
philosophy. This means that loss of any one 
component can be tolerated without compro- 
mising the mission, and loss of a second com- 
ponent will not result in loss of vehicle or crew. 
Obviously, this requires redundant systems and 
system components. Managing this redun- 
dancy adds to shuttle complexity. 


The third level of protection is the human 
element: crew, MCC, and LCC training. In 
order to quickly and correctly respond to 
performance or systems problems, as well as 
complex multiple failures, the flight crew and 
ground crews must be experts оп shuttle 
systems and how to control them. Prior to 
flight, both the ground teams and the crew 
participate in many hours of intense simula- 
tions to improve their teamwork and knowl- 
edge of shuttle systems. A stringent certifica- 
tion process is also in place to ensure qualified 
and current personnel in all disciplines. 


Failures tend to fall into two general categories, 
single component and multiple. 


For single-component failures, patience is 
important. Shuttle design should allow time to 
properly analyze what has happened and what 
steps are necessary to regain the lost component 
or to optimize remaining systems to protect 
against additional failures. А common error 
among inexperienced personnel is to act too 
quickly, do the wrong thing, and make the 
situation worse. 
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Multiple failures are more difficult to deal with, 
because reaction time must be short, апа 
procedures may not be explicit. Most FDF 
procedures are written considering a maximum 
of two failures. To avoid burdensome com- 
plexity and to maintain credibility, this is the 
only way to realistically tailor procedures to a 
vehicle as complex as the shuttle. The result is 
that a specific procedure may not be available to 
guide the crew, or several procedures must be 
combined or executed in rapid succession. For 
these cases, the crew and ground teams must 
rely on their knowledge and training. Once 
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again, reacting too quickly can jeopardize 
vehicle integrity. 


To cope with potential failures in a dynamic 
environment, such as ascent or entry, the flight 
crew must constantly keep in mind their current 
status and mentally prepare for potential 
additional failures before they occur. This 
“staying ahead of the airplane” philosophy, 
along with system reconfiguration for 
optimization and built-in graceful degradation of 
systems, enhances the chances of a successful 
outcome when multiple failures are encountered. 


61 LAUNCH ABORT MODES AND 
RATIONALE 


CONTENTS 


Mode 1 - Unaided Egress/ Escape 


Mode 2 - Aided Escape 
Mode 3 - Aided Escape 
Mode 4 – Aided Escape 


A shuttle launch may be scrubbed or aborted up 
to solid rocket booster (SRB) ignition. 
Normally, launch scrubs prior to space shuttle 
main engine (SSME) start are followed by an 
orderly safing procedure and crew egress, 
assisted by the closeout crew. A fully fueled 
shuttle on the launch pad may present an 
extremely hazardous situation if toxic vapors, 
fire, or structural damage are present. A launch 
abort after SSME start is automatically 
controlled by the ground launch sequencer 
(GLS). The most serious hazard here is the 
presence of excess hydrogen, resulting in a 
hydrogen fire, which is invisible to the eye and 
very dangerous. This situation occurred during 
a launch attempt for STS-41D. 


In the event of an emergency at the launch pad, 
the NASA Test Director (NTD), who mans a 
console in the Launch Control Center (LCC) 
firing room, is in command. Priority is flight 
and ground crew egress and escape, followed 
by preventing destruction of the shuttle, 
facilities, complex, and support equipment. 


Should an abnormal event occur that terminates 
a flight or prelaunch operation and results in 
substantial damage to the shuttle and/or injury 
to personnel, the NTD will declare a contingency 
situation. This alerts fire and rescue personnel 
and puts in motion pre-planned procedures to 
minimize further damage and injuries. 


The NTD may also initiate action if an emergency 
condition exists that requires immediate action to 
prevent loss of life or destruction of equipment. 
In preparation for a potential emergency 
condition, a hazardous condition may be 
declared if there is a threat to personnel health or 
safety. A hazardous condition may develop into 
an emergency condition. 
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Depending upon the severity of the situation on 
the launch pad, an emergency egress/escape 
may be required to evacuate personnel. The 
shuttle program has classified four launch pad 
escape modes that are preplanned and 
rehearsed by the flight crew, closeout crew, and 
all launch pad personnel. Defining these modes 
prior to the development of an emergency 
condition or contingency situation ensures 
standard procedures can be followed and 
minimizes risk of additional injury and damage. 


Mode 1 - Unaided Egress/Escape 


This escape mode may be initiated by the NTD 
or flight crew. The NTD will direct that the 
orbiter access arm (OAA) be returned to its 
position at the crew module hatch. The 
fire/rescue crew will be dispatched if the NTD 
decides it is safe to do so. Escape from the 
shuttle vehicle and the pad is performed by the 
crew. This procedure is practiced in trainers 
and mockups in Houston and rehearsed during 
terminal countdown demonstration test (TCDT) 
at KSC. Because crew complement varies from 
flight to flight, each crew must develop their 
own particular procedures. Using a buddy 
system is strongly recommended. Egressing the 
shuttle along the OAA and across the pad 195 ft 
level to the slidewire baskets through the water 
deluge fire suppression system is a hazardous 
operation. Given the very real potential of fire, 
toxic vapors, and explosion, flight crews must 
be well-trained and prepared. 


Mode 2 - Aided Escape 


Aided escape is initiated by the NTD, flight 
crew, or closeout crew. This mode is used when 
the closeout crew is still on the pad. The 
closeout crew leader is responsible for ensuring 
that all personnel egress from the shuttle and 
proceed along the prescribed escape route to a 
safe area. The NTD will also alert the 
fire/rescue crew. Injured personnel will be 
assisted/carried along the escape route, and 
basic first aid will be rendered if required. The 
closeout crew leader keeps the NTD informed 
of medical conditions and  egress/escape 
progress. 
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Mode 3 - Aided Escape 


Initiated by the NTD or flight crew, this mode is 
used after the closeout crew has departed, and a 
contingency occurs that requires assistance. 
The OAA is repositioned, and the fire/rescue 
crew proceeds to the pad to assist the flight 
crew. The actual egress/escape is similar to the 
Mode 2 operation, except the fire/rescue crew 
substitutes for the closeout crew. 


Mode 4 - Aided Escape 


This mode is initiated by the NTD, closeout 
crew, or flight crew. It involves a contingency 
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where one or more members of the closeout 
crew or flight crew are trapped or injured. 
Rescue and escape are performed by the 
fire/rescue crew, assisted by the closeout crew 
and flight crew. Use of all seven slidewire 
baskets may be required. Personnel account- 
ability is critical. 


In summary, launch aborts may range from a 
scrub/turnaround to a complex rescue scenario. 
Crews must be very familiar with all hardware 
and procedures. This requires training and 
practice. Prior to any launch pad evolution, a 
careful review of emergency procedures is 
warranted. 


6.2 А5СЕХТ АВОКТ5 
CONTENTS 


Performance Aborts 


Systems Aborts 
Range Safety 


Events that require an ascent abort can be 
generally grouped into performance and sys- 
tems failures. Flight Rules that govern these 
two types of scenarios are incorporated into 
various real-time MCC calls, along with the NO 
COMM MODE BOUNDARIES and the SYS 
FLIGHT RULES cue cards. 


Performance Aborts 


The amount of performance lost when a shuttle 
engine loses thrust or fails is directly related to 
the time of the problem. Early engine degrada- 
tion or failure while the shuttle is heavy with 
fuel may preclude achieving a safe orbit. Late 
engine problems may result in no underspeed 
at all. Fortunately, it is not necessary to fly all 
the way to main engine cutoff (MECO) to find 
out how large the underspeed will be. By using 
a computer program called the abort region 
determinator (ARD), MCC can predict the 
underspeed that will result from any perform- 
ance problem. Thus, the MCC can immediately 
determine whether the desired or even a safe 
orbit can be achieved. If a safe orbit cannot be 
achieved, some type of abort will be required. 


There are two basic types of ascent abort modes, 
intact and contingency. Intact aborts are 
designed to provide a safe return of the orbiter 
to a planned landing site. Contingency aborts 
are designed to permit crew survival following 
more severe failures when an intact abort is not 
possible. A contingency abort could result in 
either a landing at an East Coast Abort Landing 
(ECAL) site or in a crew bailout over the ocean. 


The intact aborts will be discussed here. 
Contingency aborts are discussed in section 6.7. 


For cases where the orbiter comes close to 
achieving normal orbit, the abort might simply 
consist of going to a lower, but perfectly safe, 
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If even a low orbit cannot be achieved, an abort 
once around (AOA) may be used. The orbiter is 
placed into a suborbital trajectory leading to a 
landing after a single revolution around the 
Earth. 


The next available abort mode, if performance 
does not permit an AOA, is a transoceanic abort 
landing (TAL), which results in landing on a 
runway in Europe or Africa. 


Finally, for intact aborts, if an engine fails after 
lift-off and before TAL is possible, a return to 
launch site (RTLS) abort would be performed. 


During powered flight, the crew tracks vehicle 
present abort capability by MCC voice calls. If 
communications are lost, the NO COMM 
MODE BOUNDARIES card provides a sum- 
mary of ascent abort mode capability. 


NEG RETURN (104) 
PRESS TO ATO (104) 
SE OPS 3 (109) 

SE ZZA (104) 


NEG BEN (2 @ 67) 

SE PRESS (104) 

NEG MRN (2 @ 67) 
LAST РКЕ МЕСО TAL 2 


== SE OPS 3 MRN (109)(13)_____ 


мм 
МЕМ, ВЕЈ, FFA 
FMI, KBO 24500 


ESN 24900 | ЕО VI Е 

22А 25000 | SE ops 3 BEN (109) (121 | 

KKI 25100 

JDG 25200 | SE BEN (104) 21-01 
ЕВ 2-4 АЅС/116/ҒІМ 


NO COMM MODE BOUNDARIES Cue Card 


This card does not reflect off-nominal perform- 
ance such as a stuck throttle. Only the ARD can 
calculate abort mode boundaries based on 
actual performance. The ARD takes real-time 
performance into account when predicting real- 
time mode boundaries. 


The abort mode boundaries are flight specific. 
limes change significantly because of 
differences in mass properties, environmental 


orbit. This is called an abort to orbit (ATO). modeling, and performance characteristics. 
Boundary names may also change. For 
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example, some missions will not have a Press to 
ATO boundary. Also, TAL sites are mission 
specific. Higher inclination flights require a 
different philosophy of calls and checklist mode 
boundaries than lower inclination flights. 


What follows is a generic discussion of mode 
boundaries. Flight-specific data is available from the 
Flight Dynamics Officers (FDO). 


Two-Engine TAL 


TWO-ENGINE TAL is the earliest inertial 
velocity (V,), at which AUTO guidance, using 
only two SSMEs, will achieve the desired 
MECO targets to the designated TAL landing 
site. 


An engine failure prior to this point will most 
likely mean an RTLS. 


Even after this point, RTLS capability is still 
available. TAL, however, is typically preferred 
for engine failures in this overlap region. 
Single-engine completion capability is attained 
much earlier for TAL than RTLS, and the TAL 
profile is not as dynamic as the RTLS profile. 
On the other hand, in cases of severe systems 
failures that require the crew to land as soon as 
possible, an RTLS may be preferred over TAL. 


Negative Return 


NEGATIVE RETURN represents the last 
opportunity to abort RTLS and still achieve the 
desired MECO targets. Past this V, the orbiter 
wil have too much downrange energy to 
successfully return to KSC. 


An engine failure past Negative Return will 
most likely mean a TAL. 


Press to ATO 


This boundary represents the earliest V, at which 
AUTO guidance can achieve the design 
underspeed at MECO with only two SSMEs. 
This typically requires having to abort ATO and 
performing a pre-MECO OMS dump to reduce 
vehicle weight and improve ascent performance. 


An engine failure prior to this point will most 
like mean a TAL. 
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The constraints on design underspeed are ET 
impact, minimum performance minimum 
altitude, contingency c.g. envelope protection, 
and minimum net positive suction pressure 
(NPSP) for the main engines. 


Press to MECO 


Like Press to ATO, this boundary also represents 
the earliest V, at which AUTO guidance can 
achieve the design underspeed at MECO with 
only two SSMEs. The difference here is that the 
vehicle now has enough velocity that no abort is 
necessary and a pre-MECO OMS dump will not 
be required. 


An engine failure prior to this point will most 
likely mean an ATO. 


SE OPS 3 109 


The single-engine (SE) OPS 3 boundary 
represents the point in the ascent where two 
engines can fail and the flight will continue the 
ascent to MECO for an OPS 3 entry instead of 
an OPS 6 entry. It also represents the dividing 
line between two Contigency Abort procedures: 
CONT 2 OUT SECOND and CONT 2 OUT 
ОКООР (see section 6.7). 


Ihe SE OPS 3 boundary is a function of 
Bermuda/east coast abort landing (BDA/ 
ECAL) capability, emergency landing site (ELS) 
capability, and the ability to target a TAL or ELS 
without descending below 265,000 feet during 
powered flight (minimum  droop altitude). 
Going below the minimum droop altitude 
violates ET heating constraints, and loss of 
vehicle is expected. Although European ELSs 
can be used for determining the SE OPS 3 
boundary, typical ELSs are islands well short of 
the planned TAL site, such that single-engine 
runway capability occurs as early as possible in 
the powered trajectory. Depending on 
inclination, the island runways used are Lajes, 
Azores; Las Palmas, Canary Islands; and 
Amilcar Cabral, Cape Verde Islands. 


In case droop capability comes before the last 
possible BDA/ECAL opportunity, SE OPS 3 
will be called on at the earliest of the following: 
last BDA/ECAL, first ELS, or single-engine 
limits to an augmented contingency landing site 
(ACLS). 
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In any case, capability to a runway exists for ай 
these boundaries. 


If BDA/ECAL capability does not overlap 
droop capability or there is no BDA/ECAL 
capability, the SE OPS 3 boundary may not 
ensure runway capability because the boundary 
will be called solely on the minimum droop 
altitude, without regard to TAL/ELS runway 
capability. A bailout likely will be necessary. 


Single Engine TAL (104) 


This boundary represents the earliest V, where 
AUTO guidance can achieve the desired TAL 
targets line after two simultaneous engine 
failures. 


Two engines failing prior to this point will most 
likely mean a Contingency Abort. 


Single Engine Press 


This boundary represent the earliest Ут after 
which AUTO guidance can achieve the critical 
underspeed after two simultaneous engine 
failures. 


Two engines failing prior to this point will most 
likely mean a TAL. 


Critical underspeed is the same as design 
underspeed, excluding the ET impact and NPSP 
constraints. Other criteria may be found in the 
Flight Rules. 


Last Рге-МЕСО TAL 


This boundary (not normally called out by 
MCC) represents the last opportunity to abort 
TAL pre-MECO and still achieve the proper 
TAL targets. 


If a TAL is desired after this point, the crew will 
need to manually command MECO before a 
certain Vi (mission dependent) апа then 
perform a post-MECO TAL. 


Last TAL 


This boundary (also not normally called out by 
MCC) represents the highest MECO velocity 
after which a TAL or ELS site is no longer an 
option. After this point, an AOA or certain 
high-energy procedures may be invoked. 
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TAL REDEZ 


SE OPS 3 and SINGLE ENGINE TAL both 
assume simultaneous engine failures. With 
staggered engine failures, these mode 
boundaries shift, depending on when the 
failures occur. 


Ihe flight | crew uses the TAL 
REDESIGNATION cue card to determine the 
new mode boundaries after the first SSME 
failure. 


ZZA TAL REDESIGNATION 
(116 OCFR1 CYC) 
" [soo [sooo [sooo fero [6200 [esoo [огоо | 
SE OPS 3 22А 109 (14)| 10800 | 10800 | 10900 | 10900 | 10900 | 11000 | 11000 
SE ZZA 104 (4) | 17500 | 17300 | 17100 | 16800 | 16600 | 16400 | 16200 
[зоо |ввоо |6700 [esoo |өэоо [ooo [7100 | 
SE OPS 3 ZZA 109 (14)| 11000 | 11000 |11100 |11100 | 11100 |11200 
SE 22А 104 (4) | 15900 | 15700 | 15500 | 15500 | 15000 | 14800 
[7200 [7300 [7400 [2500 [veo [7700 [7809 | 
SE 0Р5 3 27А 109 (14)| 11200 | 11200 |11500 | 11300 | 11300 |11300 | 11400 
SE ZZA 104 (4) |14500 | 14300 | 14100 | 14000 | 15900 | 13800 | 15700 
[oo [sooo [aro [azoo [ssoo [saco [esoo | 
SE OPS 3 22А 109 (14)| 11400 | 11400 |11400 |11400 | 11500 |11500 | 11500 
SE ZZA 104 (4) | 15600 | 13600 | 13500 | 13500 | 13400 |13400 | 15400 
[isto [seo [sro [esoo [sooo |9000 foroo |9200 | 
ЗЕ OPS 3 ТА 109 (14)| 11500 | 11500 |11500 | 11600 | 11600 | 11600 | 11600 
SE ZZA 104 (4) | 15400 | 13400 | 15400 | 15400 | 15500 |15500 | 13500 
SE OPS 3 ZZA 109 (14)| 11600 | 11600 | 11600 | 11700 | 11700 | 11700 | 11700 
SE ZZA 104 (4) | 15500 | 13500 | 15500 | 13500 | 15500 115500 | 13500 
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ZZA TAL REDESIGNATION Сие Card 


For example: 


With three engines running, SE OPS 3 and 
SE TAL will occur at a V, of 12,100 fps and 


14,200 fps, respectively. 


If an engine fails at a V, = 6000 fps, the new 
SE OPS 3 and SE TAL boundaries would be 
at a V, of 10,900 fps and 17,100 fps, 


respectively. 


These velocities assume a 109% or 104% throttle, 
as specified in parentheses. 


6. EMERGENCY PROCEDURES 
6.2 Ascent Aborts 


USA007587 
Rev. A 


Systems Aborts 


The SYS FLIGHT RULES cue card summarizes 
the Flight Rules requiring RTLS and TAL 
selection in response to critical systems failures. 


In most cases, additional insight provided by 
MCC is necessary to accurately and fully 
diagnose a failure and select the best response. 
In the event of sudden multiple failures, help by 
MCC is critical. For COMM loss, however, only 
the SYS FLIGHT RULES cue card is available. 


OMS -2HeTKs 

— 1 ОХ & 1 FU TKs (diff pods) 

—2 OX or 2 FU TKs 
|APU/HYD -impendmglossofalcapabity | X | X | 
рх | 


CABIN LEAK - (-ЕО dP/dT > 15) | x | 
CRYO – Ай О2(Н2) 


2 FREON LOOPS + [Accum Qty (4 and decr) 


and/or Flow (+)] Px | x, 
2 MAIN BUSES 4 | x | | 
THERMAL WINDOW PANE | х | | 


SYS FLIGHT RULES Card 
OMS Capability 


A severe loss of OMS capability (e.g. leaking 
propellant or helium) can make it impossible to 
continue uphill and subsequently deorbit. | 
total OMS capability is lost while still in 
powered flight, a TAL would be required. 


APU/HYD 


With the impending loss of all hydraulics, a 
trajectory option with minimum time to the 
ground is desired. This enhances the potential 
to land prior to a complete loss of hydraulics. 


Cabin Leak 


Loss of cabin pressure integrity impacts both 
breathing oxygen and equipment cooling. A 
minimum time to the ground option is required. 


Cryo 


Loss of cryo O2 or H2 will result in a loss of fuel 
cells and all electrical power. A minimum time 
to the ground option is required. 
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Freon Loops 


Losing both Freon loops will eventually result 
in loss of all three fuel cells due to lack of 
cooling. Since this is time critical, RTLS is 
preferable over TAL. 


Main Buses 


Two main bus failures preclude ET door 
closure. Since TAL entry trajectories аге 
thermally severe, RTLS is preferred. If RTLS is 
no longer possible (past NEGATIVE RETURN), 
pressing uphill is preferable to TAL. 


Thermal Window Pane 


An abort is required for the outer forward windshield 
or side hatch thermal window pane. An RTLS abort 
is selected to minimize the thermal stresses on the 
remaining windowpanes and surrounding structure. 
Entry heat loads are less on an RTLS than on other 
abort modes or during a normal landing. This choice 
provides a better chance of the remaining panes and 
surrounding structure surviving entry. 


Range Safety 


Launch vehicles convert vast amounts of 
chemical potential energy into equally vast 
amounts of kinetic energy to put their payloads 
into orbit. Despite all planning, design, and 
tests, the possibility that a malfunction could 
cause a vehicle to fly out of control toward a 
populated area must be considered. Range 
Safety's function is to terminate flights that are 
far enough out of normal bounds to endanger 
populated areas. During first stage, this is 
accomplished by remotely detonating explosive 
charges aboard the SRBs. During second stage, 
the responsibility for range safety is on the 
MCC/crew, with inputs from Range Safety at 
KSC. 


To protect populated areas, impact limit lines 
are drawn around them. No lethal piece of a 
vehicle can land behind an impact limit line. 
Since termination would have to occur well 
before an impact limit line is reached, destruct 
lines are drawn inside the boundaries of the 
impact limit lines. А vehicle passing outside 
the boundaries of the destruct line would be 
subject to termination. 


6.2-4 


Controllability 


During first-stage, trajectory deviations may 
lead to a violation of a destruct line by a shuttle 
that is still under control. It may be possible to 
return the vehicle toward its nominal trajectory 
or to safely execute an abort. Therefore, the 
Flight Director (FD) and Flight Dynamics 
Officer (FDO) are in voice communication with 
the Flight Control Officer (FCO) (formerly 
Range Safety Officer) during ascent. If the FCO 
detects a violation, the FDO and FD are 
immediately informed. The FD must determine 
whether the shuttle is controllable ог 
uncontrollable, and inform the FCO. As long as 
the FD declares the shuttle controllable, the 
FCO takes no action to terminate the flight for 
trajectory deviations alone. 


Range Safety Limit Avoidance 


A deviation from nominal trajectory that is 
large enough to warrant FCO action must be 
corrected. First-stage options are: 


e State vector update 
e Select CSS (after 90 seconds MET) 
e Engage BFS 
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In second stage, the options are: 
e State vector update 
е ATOselection 
e Select CSS 
е TAL or RTLS selection 
e Engage BFS 


e SSME manual cutoff. For loss of 
comm, FCO will send the ARM 
command as a cue for manual MECO 


Options are listed in order of priority. Тһе 
priorities are established such that higher 
priority options preserve lower priority options 
and involve fewer new dangers to the crew and 
shuttle when possible. 
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6.3 RETURN TO LAUNCH SITE 


CONTENTS 


Powered RTLS 
Gliding RTLS 


RTLS abort is designed to provide intact abort 
capability for a suborbital return of the shuttle 
to the KSC Shuttle Landing Facility (5ГЕ). An 
RTLS abort may be declared for an engine 
failure after lift-off and prior to NEGATIVE 
RETURN. 


In order to reach the SLF, the shuttle must 
reverse course and fly back the way it came. 
The turn to reverse course is called powered 
pitch around (PPA). Timing of this maneuver is 
critical. Engines must be shut down when the 
shuttle has exactly enough speed and altitude to 
glide to the SLF runway. Also, for safe 
separation, the ET must have no more than 2% 
propellant remaining. Excessive propellant will 
slosh and could cause the ET and shuttle to 
collide. 


Selection of an RTLS abort is driven by several 
factors. Heat loading on the ET restricts RTLS 
selection to no earlier than 2 minutes 30 seconds 
(2+30) after lift-off. For RTLS systems aborts, 
selection occurs at 3 minutes 40 seconds. Abort 
overlap allows either an RTLS or a TAL to be 
selected. When RTLS/TAL overlap exists, TAL 
may be the preferred mode, since a second 
engine failure can be accepted much earlier and 
still make the runway. Also, the powered flight 
phase of RTLS is several minutes longer, causing 
more exposure to some types of MPS/SSME 
failures. An RTLS however, gets the orbiter back 
on the ground sooner and is not as thermally 
stressful as a TAL. 


Once the decision is made to initiate an RTLS 
abort, MCC will direct the crew to “Abort 
RTLS.” The FD will also turn on the ABORT 
light on panel F6, using a switch on their 
console, as a backup to the voice call. Onboard, 
moving the ABORT MODE rotary switch to 
RTLS and depressing the Abort pushbutton 
reconfigures GNC software to RTLS. As a 
backup, the crew can enter OPS 601 PRO on any 
PASS keyboard. 


500 т т 
Powered RTLS 
Fuel dissipation Pitch around 
35° to 60° pitch V=5to 7.2 
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-L ý 45° to 65° 
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= 300 trajectory EE 
> 
Ф 
= 
= 
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х RIES ET SEP V = 5.210 5.45 
glide SX 
SRB staging EA “ 
100 ~ ын Nominal entry 
Start "g" control trajectory 
V=5.8 
ET trajectory 
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Rev. A 
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At 3:40 (3 eng) 
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Pitchdn (В = 0°, о = -2°) ЗРОВК @ 3000 ЕТ |_______ 
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Powered RTLS 


Powered RTLS (PRTLS) begins when the abort 
is initiated and terminates at МЕСО. PRTLS 
guidance is designed to deliver the shuttle 
to а MECO location at the proper altitude 
(I-load), flight path angle, and speed (function 
of range). 


Guidance during PRTLS is closed loop. 
Computed MECO conditions are compared to 
desired MECO targets to determine a miss 
vector. This vector is then used to compute 
corrections in steering and throttle commands. 


The crew monitors guidance using cue cards 
and DPS displays. 


Should guidance not converge, the crew will see 
“GUID INHB” on the RTLS TRAJ display. 
MCC, in conjunction with the crew, will request 
CSS takeover if guidance does not converge 
within a reasonable time. 


The primary display for PRTLS is RTLS TRAJ. 
Some of the information on this display comes 
directly from МАУ and is independent of 
guidance. 
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PASS RTLS TRAJ Display 


The central portion of the display is a plot of 
altitude versus horizontal component of Укы, 
with the zero-velocity point at the end of the 
top trajectory line to the left of the screen 
midpoint. Shuttle position is plotted with a 
triangle. Predictors are generated to show 30- 
and 60-second positions. Trajectory lines are 
approximations of a generic set of high and low 
dispersed trajectories for an engine out at lift-off 
and just before negative return. 


On the left side of the ВЕб ASC TRAJ, there is a 
scale for delta H dot and angle of attack (o). 
The delta H dot scale is not used operationally 
and is not trained. The scale is intended to 
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provide а “fly to” indication for controlling 
altitude rate during the RTLS profile. However, 
this scale is referenced to a canned RTLS profile 
and, therefore, is not useful in most cases. The 
alpha scale is just a graphical representation of 
the NAV-derived angle of attack. This scale 
also is not used operationally and, therefore, is 
not trained. The middle of the scale has a mark 
at -4°, which was intended to provide a 
reference during ET SEP while trying to 
maintain an AOA of -4° for separation. 
However, the desired angle of attack for ET SEP 
is now -2°, so the scale does not provide a good 
visual cue for the separation. 


Two guidelines at the left end of the lower 
TRAJ line depict the q-bar limit for ET SEP. The 
shuttle symbol should be between these two 
lines, while approaching MECO. The lower line 
represents q-bar at 1 psf and the upper line 
represents q-bar at 2 psf. 


A delta range scale at the top of the display 
represents current glide range. Near MECO, 
the cutoff bug moves from right to left, passing 
the pitchdown points for 3-engine (PD3) and 
2-engine (PD) PRTLS. The cutoff (CO) point 
indicates where MECO should occur to obtain 
proper glide range to the runway. 


Digital readouts present useful data for 
monitoring performance. Additional readouts 
on the BFS RTLS TRAJ present computed 
values of sideslip (beta), angle of attack (alpha), 
total vehicle acceleration, attitude errors, and 
computed throttle command. 


68117 RTLS TRAJ 2 5 806/80 :03:88 
Е BFS 90850/06:00:08 
АН = y 
"е со PD РОЗ 
в -8.27 
« -33 GUID за 
1248 РРА 1 
ТМЕСО 18:22 
PRPLT 68 
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To function properly, guidance needs to know 
the shuttle’s speed and time when an engine 
fails. Normally, the GPCs will capture this 
data, but the crew should also note the time. 
This becomes important later to determine key 
trajectory parameters. 


NOTE 


If CSS flight control is selected, manual 
throttle control must also be selected. 
This will require manual throttle down 
and shutdown. 


Fuel Dissipation 


After abort selection, the first phase is fuel 
dissipation. During fuel dissipation, the shuttle 
continues heading downrange at a fixed inertial 
thrust direction. Cyclical computations are per- 
formed to determine the proper time to initiate 
turnaround. Should the abort be declared near 
the NEGATIVE RETURN boundary, рисћ- 
around may occur immediately with no fuel 
dissipation. 


For the crew to fly fuel dissipation phase 
in CSS, they must know the proper pitch angle 
(theta) and when to pitch around. Using the 
engine fail time, the RTLS cue сага 
UNCONVERGED GUIDANCE TABLE 15 


entered and the appropriate theta and 
pitcharound propellant remaining аге 
determined. Theta is chosen to minimize 


altitude loss while heading away from the 
runway. Once set, it remains constant through 
the fuel dissipation phase. 


Powered Pitch Around 


This turn changes shuttle attitude from heads- 
down going away from the launch site to heads- 
up pointing toward the launch site by an 
approximately 60? to 70? pitchdown maneuver. 
Until zero relative velocity is reached, the 
shuttle is still moving away from the launch 
site. Powered pitch around is performed at 10? 
per second pitch rate in AUTO. This is a 
dramatic maneuver and is designed to prevent 


Е lofting while passing through vertical 
orientation. 
DPS MENU 
AB | "um Norm 
BFS RTLS TRAJ 2 Display 
6.3-3 6. EMERGENCY PROCEDURES 


6.3 Return to Launch Site 


USA007587 


Rev. А 


Timing of powered pitch around is critical and 
must occur within a certain interval to ensure 
the shuttle arrives at MECO with the proper 
amount of fuel remaining and the proper 
energy. The crew monitors guidance using the 
GUID % to go on the RTLS TRAJ 2 display. The 
percentage displayed is the percent deviation of 
the predicted final mass from the RTLS mass 
target. When the percentage equals zero, PPA 
should occur. 


Should guidance be unconverged, the crew 
should select CSS and manual throttle control 
and pitch around manually at the appropriate 
propellant remaining cue. 


NOTE 


It is much better to pitch around slightly 
early than slightly late as late pitch- 
arounds may result in not reaching a 
nominal RTLS MECO state. 


OMS Dump 


OMS propellant onboard at launch is mission 
specific. Because the propellant is stored in 
tanks located near the back end of the shuttle, it 
causes the c.g. to be considerably aft of the point 
at which the shuttle is designed to fly. For 
aborts such аз RTLS, this excess propellant is 
dumped. 


The dump is actually a burn, using the OMS 
engines and possibly the aft RCS jets. For inter- 
connected dumps, valves are reconfigured by 
the GPCs to allow OMS propellant to be burned 
through the RCS jets. When RTLS is selected, 
the OMS engines begin burning immediately. 
Smart Interconnect takes approximately 3 
seconds to reconfigure and check the valves. 
Some missions have interconnected-inhibited 
dumps where the dump is through the OMS 
engines only. 


Normally, RTLS dumps are a combination of 2 
OMS engines and 24 aft RCS jets. The jets used 
are 4 +X jets and 20 null jets. The +X jets fire 
directly aft and produce по significant 
rotational movement. Null jets fire in opposite 
directions so that they cancel each other out. 
Dump times are mission specific and are 
depicted on the RTLS/TAL DUMPS cue card. 


RTLS DUMP 
= Abort Select 2 OMS КЕ 
Рге 
МЕСО 24/10 RCS (Нот OMS) 
(If INCNCT 'ENA’) 
[2 | 2] 4] [2 [0 [8] sec 
2+ 10jets 2+24jets 2 OMS 
:00 :03 
4>20 
ММ 602 + :20 апа ММ 602 
Fost FRCS 
MECO RESIA Ж. Dump У | 
:00 01] 8 [8 ]sec:oo 0|1| 0 ес 
848.су5 
RTLS/TAL Dumps 


When the dump is complete, OMS/RCS valves 
are automatically reconfigured by the GPCs in 
preparation for MECO. If required procedurally, 
the crew can secure one or both OMS engines by 
placing the ARM/PRESS switch in OFF. 


Dump time-to-go (ТТС) counts down to zero 
during RTLS dumps. During the dump, the 
interconnect can be inhibited or enabled by 
toggling ITEM 5. 
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OVERRIDE Display 


Onboard failures, such as electrical or DPS 
problems, can cause serious OMS/RCS valve 
reconfiguration problems. “Smart Intercon- 
nect” Software should reconfigure the valves or 
inhibit some or all of the jets to prevent any 
serious problems. 


Shuttle abort dumps are complex procedures and 
must be executed correctly in a time-critical 
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situation. Consult the Ascent/Aborts Flight MECO and ET SEP 
Procedures Handbook for additional 1 1 
informator: Because the MECO time has been fixed by the 


GPCs, an attitude of alpha = -2 must be held 
until the delta-R bug reaches the CO mark, and 
the engines are shut down either by the GPCs 
or manually. After shutdown, a mated coast 
phase occurs for approximately 13 seconds. 
During this phase, valves are closed, umbilicals 
retracted, and electrical connections deadfaced. 
The RCS jets control attitude. 


Flyback 


This phase is part of PRTLS where the shuttle 
points back toward the runway. Guidance 
computes steering and throttle commands that 
direct the shuttle along the proper trajectory. 


Should CSS control be required, the crew 
should stop the PPA maneuver at the initial 
flyback theta, as determined from the RTLS PLT 
UNCONVERGED GUIDANCE TABLE. The 
shuttle pitch attitude must then be adjusted to 
fly back along or parallel to the guidelines on 
the RTLS TRAJ display. 


The shuttle is then ready for ET SEP, which will 
occur automatically, provided certain con- 
straints are within limits. 


DESIGN DESIGN VEHICLE 
TARGET | TOLERANCES LIMITS 
Roll rate, P [o° | +1.25°/sec 20 > P > -20 


WARNING 


Do not allow the predictors to fall below 


the lower guideline during flyback. 
Recovery from this low altitude condition 


may be impossible. 


In the area of high q-bar, the guidelines are very 
important to avoid structural overload or ET 
SEP problems. As the predictors reach the left 
edge of the display, control theta to fly between 
the guidelines until the delta-R bug begins to 
move. 


Powered Pitchdown 


To satisfy altitude and flight path angle 
constraints at MECO, a positive angle of attack 
of about 30° is required. However, to safely 
separate the ET, an alpha of -2° is necessary. 
The transition between these attitudes is called 
powered pitchdown. 


The maneuver must be completed rapidly (5° to 
8° per second) to avoid large sink rates, which 
could cause overheating ог overstressing. 
Engines are throttled back to reduce trajectory 
impact. Should CSS be required when the bug 
reaches the appropriate pitchdown mark (РОЗ 
or PD), the shuttle should be pitched down at 5° 
to 8° per second to alpha = -2°. At this point the 
crew should null beta. Simultaneously, the 
engines are manually throttled to 67 percent. 
These procedures are summarized on the RTLS 
CDR and PLT cue cards. 
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RTLS ET Auto Separation Limits 


These limits prevent separation in an unsafe 


attitude, which might cause  shuttle/ET 
collision. If the parameters are not within 
limits, an ET SEP inhibit suspends the 


separation sequence until the out-of-limits is 
corrected or 6 seconds expire, whichever occurs 
first. The timer is necessary because of rapid q- 
bar buildup, which makes a safe separation 
impossible, regardless of attitude. Separation 
can be commanded manually using the ET 
SEPARATION switch and ET SEP pushbutton 
on panel C3. 


Immediately after ET SEP, the DAP performs a 
translation and pitch maneuver to fly the 
shuttle away from the ET. This is accomplished 
by firing all of the shuttle’s downfiring jets. The 
combination of four forward and six aft 
downfiring jets results in a simultaneous 
translation and rotation, which moves the 
shuttle up and away from the ET. Once the 
shuttle achieves an alpha > +10° and time from 
ET SEP » 10 seconds, the GPCs mode to MM 
602 and the glide portion of RTLS (GRILS) 
begins. 


In CSS and manual throttle, a manual MECO 
must be performed using the MAIN ENGINE 
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SHUT DOWN pushbuttons on panel C3. The 
alpha = -2 degree attitude must be maintained 
until ET SEP. This will require a small negative 
pitch rate due to H-dot increase, which causes 
alpha to become more positive. The -Z transla- 
tion maneuver will occur automatically unless 
the CDR intervenes by moving the THC out of 
detent. If this is done, a manual -Z maneuver 
should be performed to ensure safe separation, 
and the pitch up maneuver to alpha = +10° 
must also be manually performed. Generally, it 
is preferable to allow the DAP to perform these 
maneuvers automatically. 


Gliding RTLS 


The gliding portion of RTLS is very similar to 
the final portions of entry, which are discussed 
in detail in Section 7. Only significant differ- 
ences are presented here. 


Post-MECO Dumps 


After MECO and ET SEP, the remaining MPS 
propellants must be dumped to assist in c.g. 
control and, for the liquid hydrogen, to reduce 
potential fire hazard. The MPS dump 
sequences are very similar for the nominal, 
TAL, апа RTLS modes. The [02 and LH2 аге 
dumped simultaneously to save time. 


The RTLS MPS dump starts immediately upon 
transition to MM 602. LO2 is dumped through 
the main oxidizer valves in the main engines 
and the 8-inch fill/drain line on the starboard 
side of the orbiter. LH2 is dumped through the 
1.5-inch backup dump line and the 8-inch 
fill/drain line on the orbiter port side aft. To 
ensure a rapid LH2 dump, the LH2 manifold is 
pressurized with helium. 


The onboard software also allows a роѕ МЕСО 
dump of RCS propellant through the RCS jets 
to satisfy maximum tank landing weight 
constraints and c.g. control. 


Guidance 


During GRTLS, guidance manages the shuttle's 
energy state to arrive at the runway with 
sufficient energy to complete a safe landing. 
GRTLS guidance is divided into five phases: 


® Alpha Recovery 
e Nz Hold 
e Alpha Transition 


e S-Turn 
е GRTLS TAEM 
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These phases provide for transition from a 
ballistic trajectory, through hypersonic gliding 
flight, to an energy management scheme 
designed to make the runway. 


Alpha Recovery 


Pullout from the ET SEP attitude must be 
accomplished quickly before aerodynamic 
forces build up to uncontrollable levels. To 
accomplish this, the shuttle maneuvers to a 
high (alpha = 50°) angle of attack using both 
RCS jets and aerodynamic controls. 


Increasing dynamic pressure caused by the 
shuttle falling into the atmosphere causes more 
lift to be generated by the wings. The resultant 
lift produces a Z-axis acceleration (МУ. At 
about 1.65 g, the DAP starts to reduce alpha to 
hold an М, of 2.2 g's. The shuttle М, limit for 
RTLS is 2.0 – 2.5 g's (based on the vehicle's 
weight). 


Roll jets are secured at q-bar = 10. Pitch jets are 
secured at q-bar = 40. Yaw jets are required 
until Mach = 1.0. When KEAS = 77, the speed 
brake is ramped open to about 81 percent to 
enhance lateral stability by allowing the 
elevons to be trimmed down. Below Mach = 
0.95, the speed brake position is modulated by 
GRTLS TAEM guidance. 


Nz Hold 


Alpha is smoothly decreased to maintain the 
2.2 2 limit until H-dot is greater than -320 
ft/sec. Excessive g-loading could cause 
structural damage and also dissipate excessive 
energy. The ADI pitch error needle displays N. 
error during this phase. 


Alpha Transition 


Upon termination of М, hold, alpha is changed 
to conform to a profile that is a function of 
Mach number. This profile provides the best 
vehicle control until active ranging begins in 
GRTLS TAEM. Also, a bank maneuver is 
performed, either to null any heading errors to 
the heading alignment cone (HAC) tangency 
point, or to dissipate excess energy by turning 
(S-turn) away from the HAC. The maximum 
bank angle is 45°. The ADI pitch error needle 
displays alpha error during alpha transition 
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phase. Guidance can be manually downmoded 
to the straight-in or minimum entry point 
(MEP) HAC if required due to low energy. 


To fly the alpha transition in CSS, the display in 
the upper left corner of VERT SIT 1 is used. 
The shuttle symbol initially appears in this 
portion of the display, which represents an 
alpha versus Mach number profile. The dashed 
line is the nominal profile, and the solid line is 
the q-bar limit. 


The ENTRY ALPHA cue card can also be used 
for alpha transition. Since there are no 
procedures to initiate S-turns manually, 
ranging is accomplished by exercising the OTT 
options described in Section 7. The MCC can 
also request a GCA and accomplish S-turns by 
asking the crew to fly appropriate bank angles 
or headings. 


1 000/00:14:35 
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82 
82 
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GRTLS Vertical Situation 1 Display 


Note: Shuttle symbol appears only at one 
location on the display at a time 


S-Turn 


An S-turn can be initiated in GRTLS TAEM or 
while still in alpha transition. S-turns increase 
the distance to be flown, thus decreasing 
energy. It is possible that more than one S-turn 
would be required. Starting and stopping of 
S-turns can be monitored using the E/W scale 
on VERT SIT 1. 
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GRTLS TAEM 


This phase is essentially identical to normal 
entry TAEM, which is discussed in detail in 
Section 7. The main differences are that GRTLS 
TAEM starts at Mach = 3.2 and an alpha 
limiting corridor exists. 


The MPS/TVC ISOL valves must be closed by 
the crew before the low  altitude/high 
maneuvering regions of GRTLS TAEM to 
prevent PRL. These valves must remain open 
until MPS dump completion at approximately 
Mach = 4.5, 


To conserve power during ascent, the MLS 
LRUs are powered off. They must be turned on 
and communication established (I/O RESET) at 
about 85 k ft during GRTLS. 


Postlanding procedures are the same as 
nominal end of mission, except that the 
hydraulic load test is not performed. 


RTLS Flight Displays 


RLS MM 601 
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RTLS Ascent Specific Notes 


е RTLS abort verified by letter “R” adjacent 
to MM field in upper-right corner 


ÅA karin- Relative Velocity bearing pointer 
and Beta digital readout are displayed on 
an RTLS ascent (Inertial Velocity is 
blanked) 


Runway bearing pointer appears at RTLS 
selection indicating bearing to the selected 
abort runway 


Tail of Runway bearing pointer shows 
when heading away from the RTLS site 


e SPEC 50 Runway selection, Range to 
runway in nm, and ЛА? appear at RTLS 
abort select 


e Compass Card displays magnetic heading 
on a N, E, S, W reference 


е X-Trk, AInc and CDI are also blanked at 
RTLS abort select 


e Mach/Velocity tape displays VI prior to 
PPA, then VR post PPA 


6.4 TRANSOCEANIC ABORT 
LANDING 


CONTENTS 


Nominal Transoceanic Abort 


Landing 
Post MECO Transoceanic Abort 
Landing 


The purpose of a transoceanic abort landing 
(TAL) is to provide an intact abort capability for 
single-engine failures between 2 ENGINE TAL 
and PRESS TO ATO (MECO). It also offers an 
intact option for two engine failures much 
earlier than SINGLE ENGINE PRESS. TAL also 
supports system aborts that occur after 
NEGATIVE RETURN such as cabin leaks, 
cooling problems, or OMS propellant loss. 


During a TAL abort, the shuttle flies an entry 
trajectory across the ocean to land on a mission- 
specific runway. Landing occurs approximately 
40 minutes after launch. Powered flight 
guidance has the capability to target 13 different 
landing sites, which are selected based on 
runway length, weather, and orbital inclination. 
Landing sites near the nominal ascent ground- 
track are more efficient since crossranging 
requirements are reduced. Typically, only three 
TAL sites are supported for possible use on each 
mission. 


Nominal Transoceanic Abort Landing 


TAL is selected prior to MECO by placing the 
ABORT MODE rotary switch on panel F6 in 
TAL and pressing the ABORT pushbutton. Item 
entries on the OVERRIDE display (SPEC 51) 
may also be used to select TAL should the 
ABORT MODE switch fail. The crew should 
note the title of the ASCENT TRAJ display 
changes to TAL TRAJ and the MM 103Т (flight 
instruments upper right corner) as confirmation 
that the TAL flag has been set. The shuttle 


indicator (triangle) and predictors should 
follow the upper trajectory line on Ше PASS and 
BFS TAL TRAJ 2 displays. 

Abort Dump 


When TAL is selected, an abort dump begins 
immediately. OMS propellant is usually 
dumped through the OMS engines plus 24 aft 
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RCS jets interconnected to the OMS propellant 
tanks. The OMS/RCS interconnects are deter- 
mined preflight via I-loads for each abort 
scenario. They may be enabled or inhibited by 
the crew if required. Some OMS propellant will 
be dumped in MM 304 prior to 0.05 g. This 
dump is performed primarily to increase 
separation from the ET. 


If a TAL is initiated after an I-loaded velocity 
(dependent on two or three engines remaining), 
there will not be enough time to complete the 
OMS dump. For these cases, the remaining 
engines will be throttled down automatically to 
67% to gain extra dump time. 


The OMS dump should be stopped if helium 
pressure decreases to 2,000 psi to ensure helium 
will not be ingested into the RCS lines. 


Guidance 


At abort selection, TAL guidance begins 
steering the shuttle toward the selected landing 
site plane. Variable I-Y steering is used to bring 
crossrange to the TAL site within acceptable 
limits (approximately 500 n. mi.) at MECO. 


The crew monitors guidance during TAL aborts 
using the TAL CDR and TAL PLT cue cards. 


It is important to verify, using SPEC 50, that the 
correct landing site is selected. 


Should a second engine fail during a TAL, the 
OMS dump will continue through the OMS 
engines, but the dump through the RCS will be 
terminated. The crew must push the two failed 
engine MAIN ENGINE SHUT DOWN 
pushbuttons on panel C3 to set the safing flag. 
The contingency dump must also be started 
using SPEC 51. 


Trajectory droop, along with guidance 
convergence and main engine performance, are 
the deciding factors in defining the earliest 
single-engine TAL capability. Drooping below 
the 265 k ft limit will result in either an 
explosion due to ET heating or a loss of control. 
If two engines fail near the SE OPS 3 109 
boundary, the crew should throttle up to 109 
percent. Droop guidance will engage and pitch 
up to 60° on the ADI to minimize sink rate and 
enable the shuttle to remain above 265 k ft. 
When thrust-to-weight is greater than 1, the 
shuttle will begin to climb and accelerate 
downrange. 
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То lessen ET heating effects and to put the 
shuttle in the correct entry attitude at ET SEP, a 
roll to heads up is performed at an I-loaded 
reference velocity. If the shuttle is still in the 
heads down attitude when TAL is selected, roll 
to heads up will occur at the TAL оадеа 
velocity. If the shuttle has already performed 
the nominal roll to heads up when TAL is 
selected, it will remain in the heads up attitude 
for the rest of powered flight. The roll is 
performed at 5° per second. 


TAL MECO occurs about 2,800 n. mi. from the 
landing site. For inplane sites, very little 
banking for azimuth control is necessary if 
started as soon as possible after the first MM 
304 pullout. Waiting to null out delta azimuth 
until late in the entry can severely reduce 
crossrange capability. 


The MCC will recommend the best approach to 
the field. An overhead approach is preferred. 


OPS Transition 


TAL is a unique abort in that it requires 
transition to GNC OPS 3 after MECO and ET 
SEP, which 1$ time-critical. The PASS 
computers obtain this software from upper 
memory. 


WARNING 


To prevent loss of control, engage BFS and 


type in OPS 301 PRO if the PASS does not 
mode into OPS 3 within 68 seconds. 


The 68 seconds mentioned above are a holdover 
from when the OPS 3 software had to be loaded 
from the mass memory units. The maximum 
time it would take to try and load the software 
after attempting both SSMMs is 6-8 seconds. 


About 3 minutes are available to complete the 
OPS transition between ET SEP and the start of 
dynamic pressure buildup depending on the 
altitude, flight path angle, and velocity at 
MECO. This period is critical. The shuttle is 
entering the atmosphere, and the TRANS DAP 
is not designed for atmospheric flight. АП 
procedures must be completed quickly and 
accurately. Ignore all systems problems unless 


6.4-3 


USA007587 
Rev. A 


they are extremely critical until correct entry 
flight control is available. 


Post-MECO Dumps 


An MPS dump similar to the RTLS dump 
begins automatically at MM 304. The TAL LH2 
MPS dump is unpressurized. 


Once in MM 304, the OMS dump restarts to 
ensure separation with the ET. This dump adds 
about 100 fps AV to the shuttle’s energy. 
(Several missions have used 200 fps AV.) For 
post-MECO TALs, the dump also ensures 
orbiter landing weight, c.g., and tank landing 
weight constraints are met. 


The FRCS null jet dump typically starts at MM 
304 to help control X c.g. location. 


An aft RCS dump is commenced at Увш, = 9 k 
fps. This dump reduces aft propellant to meet 
weight and c.g. constraints. The dump time is 
an I-load, which is usually 88 seconds. Should 
the aft RCS quantity be low, the dump can be 
inhibited using SPEC 51. For missions with 
forward X c.g. concerns, this dump will not be 
performed. 


Entry 


MM 304 is very similar to a normal end-of- 
mission entry (discussed in detail in Section 7) 
with the exception of the 43° initial angle of 
attack flown during the TAL pullout phase 
which protects for high wing leading edge 
temperatures. 


Post MECO Transoceanic Abort Landing 


An intact abort capability is available between 
Vi 721.5 to 23 К fps (mission specific) and AOA 
capability by using the TAL entry software. 
The abort is declared after MECO. For late 
systems problems after last pre-MECO TAL, the 
crew performs a manual MECO at the specified 
velocity using the MAIN ENGINE SHUT 
DOWN pushbuttons. 
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NOTE 


For high inclination missions, a crew- 
initiated (MAN MECO) post-MECO TAL 
is not an option. This is because, for high 
inclination missions, the post-MECO TAL 
landing sites are emergency landing sites 
(ELSs), and the program has decided to 
try for an AOA rather than land at an 
ELS. 


MECO velocity takes into account the AV due to 
SSME tailoff. This number is flight specific and 
depends upon inclination. 


The boundaries chart shows approximate TAL 
site coverage for a range of early MECO 
conditions. Using the real time downrange 
abort evaluator (DAE), the MCC will determine 
the appropriate site and communicate data to 
the crew. Cue card boundaries are used for loss 
of communications. 


High Energy TAL 


MECO velocities between approximately 24.5 k 
and 25.2 k fps may be too low for AOA 
capability (especially if the OMS propellant has 
been dumped) and too high for auto guidance 
to make a TAL site. For inclinations <57°, a 
high-energy TAL procedure is available. This 
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procedure uses high angles of attack, prebank, 
and OMS dumps to dissipate excess energy and 
to allow the orbiter to land at a TAL site from 
these MECO velocities. For inclinations >57° 
the only option in this situation is to abort to an 
ELS or to bail out. 


Post MECO Dump 


The high-energy TAL рові-МЕСО OMS dump 
is similar to the TAL OMS dump. 
Interconnected dumps аге performed 
automatically only in indicated regions. 


Guidance 


Upon entry into MM 304, guidance will roll the 
shuttle to heads up, if not there already. 


The crew should verify that the proper runway 
is selected. For low energy cases, low energy 
logic is required until the shuttle is within the 
trajectory lines on the ENTRY TRAJ display. 


After runway selection is verified, and guidance 
is converged, AUTO flight control may be 
reselected. The remaining high-energy TAL 
procedures are identical to the nominal TAL. 
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CONTENTS 


The abort once around (AOA) abort mode is 
used in cases where shuttle performance has 
been lost to such an extent that it is impossible 
to achieve a viable orbit, or not enough OMS 
propellant is available to accomplish the OMS- 
1, OMS-2, and deorbit burns. AOA may also be 
used when a major systems failure makes it 
necessary to land quickly. 


In an AOA for a standard insertion, or a low 
performance direct insertion, one OMS burn is 
made to adjust the post MECO orbit such that a 
second burn will result in the orbiter deorbiting 
and landing at an AOA landing site. пап AOA 
Юг а systems failure during а nominal 
performance direct insertion, only the deorbit 
burn is required. Landing occurs about 1 hour 
and 45 minutes after lift-off. 


There are two AOA trajectories with several 
different options for each one, depending upon 
the reason for performing an AOA: steep AOA 
and shallow AOA. 


Entry trajectory for the steep AOA is very 
similar to a nominal entry and is the preferred 
trajectory due to thermal considerations. 
However, steep targets require more AV and 
therefore more propellant. Shallow AOA 
results in a flatter trajectory, which places the 
shuttle closer to the skipout boundary and 
thermal limits. This is less desirable, but 
requires less OMS propellant, which is 
important for severe underspeed cases or if both 
OMS helium tanks have failed with propellant 
quantities above max blowdown. 


Execution of an AOA is determined by an MCC 
call and by checking the OMS-1 target solution 
against the OMS 1/2 TGTING cue card. | 
required, OMS-1 targets are loaded and burned. 
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After OMS-1, the desired OMS-2 targets are 
selected on the MNVR EXEC display. Then the 
software is moded to OPS 3 and the appropriate 
OMS-2 (deorbit) targets are loaded and burned. 
After the deorbit burn, an entry is flown that is 
very similar to the nominal end of mission. 


OMS-1 


AOA can only be selected post MECO by crew 
selection of an AOA target set on the OMS 
MNVR display. 


The OMS-1/2 targeting chart provides the crew 
with information describing the appropriate 
OMS-1/2 target sets as a function of MECO 
underspeed. This cue card assumes no system 
failures but does account for any ATO dump 
performed pre-MECO. The crew obtains the 
correct target set by calculating orbital energy 
(HA + HP) and noting the amount of OMS 
propellant remaining. Current HA + HP is 
obtained from the OMS-1 MNVR EXEC display 
after MM 104 transition. 


The OMS 1/2 TGTING cue card should be used 
in conjunction with the OMS-2 TARGETING 
card, and worst case requirements will prevail. 
For combinations of failures, MCC help will be 
required. In any case, MCC is prime for all 
target selections as long as COMM exists. 


For all flights there is an ATO OMS-1 target set 
that will allow either an ATO, AOA steep, AOA 
shallow, or minimum perigee (MIN Hp) OMS- 
2. This target set is referred to as the common 
targets. The common targets can be burned, 
and the decision to abort AOA may be delayed 
until after OMS-1 for most cases. If AOA is 
selected after OMS-1, the crew depresses the 
hydraulic systems instead of shutting down the 
APUs. This step avoids an APU shutdown and 
restart. Running the APUs in LOW PRESS 
instead of NORM PRESS will conserve APU 
fuel for entry. 
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OMS-2 


After OMS-1 is burned, the OMS-2 TARGET- 
ING cue card is checked to determine the 
appropriate OMS-2 targets. Additionally, the 
OMS REQUIRED card is used to determine the 
appropriate abort mode in the event of an OMS 
propellant shortage or to confirm that sufficient 
OMS propellant is available for completion of 
the planned abort mode. 


OMS targeting options are complex and vary 
greatly from flight to flight. For a complete 
explanation of targets, refer to the Ascent/ 
Aborts Flight Procedures Handbook. 


For all AOA aborts, deorbit targets are called up 
in OPS 1 and carried across the transition to 
OPS 3. Targets are not loaded until after the 
OPS 3 transition because of different guidance 
targeting logic. Where the OMS-1 maneuver (if 
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required) establishes a temporary orbital 
trajectory, OMS-2 is a deorbit burn. 


AOA software computes the amount of excess 
OMS that may be burned out of plane during 
the deorbit maneuver. The crew can change 
this amount through keyboard entries on the 
OMS MNVR EXEC display. 


Once the appropriate AOA OMS-2 targets are 
loaded, burn TIG may need to be adjusted to 
correct range from entry interface (REI). The 
FDF checklist provides the procedure for TIG 
adjust. The MCC may recommend a TIG that 
has already been adjusted. 


If the key-in AOA targets are used, an AOA 
target set should still be called up in OPS 1 
using Item 35 on the OMS MNVR display to 
establish the AOA Kalman filter covariance 
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matrix. The key-in AOA targets can then be 
entered and ultimately loaded in OPS 3. 


Entry 


After the OMS-2 burn, the orbiter is 
maneuvered to an EI-5 attitude, which is similar 
to the nominal entry attitude. If AOA shallow 
targets were burned, a prebank will be required 
to ensure atmospheric capture. 
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The software transition from OPS 1 to OPS 3 
will automatically load landing site data for an 
AOA. Included are data for the runways 
shown on the HORIZ SIT SPEC 50, an 
associated set of TACAN stations, and MLS data 
Юг the primary апа secondary runways. 
Potential AOA landing sites are Edwards Air 
Force Base, California; Kennedy Space Center, 
Florida; and Northrup Strip, New Mexico. The 
crew should verify that the appropriate site and 
runway are selected. 


The entry and landing phase of an AOA is 
similar to the normal entry and landing 
discussed in Section 7. 
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CONTENTS 


ATO aborts are designed to achieve a safe orbit 
that is lower than the nominal orbit. This 
requires less OMS propellant and allows time 
for problem evaluation to determine whether an 
early return is required or additional burns can 
be performed to raise the orbit and continue the 


mission. ATO may be selected for either a 
performance shortfall or certain systems 
failures. 

Powered Flight 


ATO 15 selected pre-MECO by using the 
ABORT MODE rotary switch or by item entry 
on SPEC 51. Primarily, рге-МЕСО ATO selec- 
tion provides an OMS dump, switches to abort 
MECO targets (often the same as nominal), and 
may enable variable I-Y steering to freeze the 
inclination. The OMS dump adds performance 
by reducing weight and adding thrust. 
Freezing the inclination increases performance 
because in-plane is always the most fuel 
efficient route to orbit. 


Three I-Loaded variables will determine dump 
size and inclination. 


V_LIN - An ATO selected post V_LIN will 
result in less than a full dump. The amount 
dumped will, from there, ramp down to zero as 
a function of velocity. 


V_ZERO - An ATO selected post V_ZERO will 
result in zero OMS propellant dumped. 


V MSSN CNTN - Ап ATO selected post 
V MSSN CNTN will result in the nominal 
mission specific inclination. That is, the 
inclination will not be frozen as it has been 
determined that a safe orbit can be archived 
without an inclination adjustment. 
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As with nominal trajectories, the crew monitors 
ascent performance and keeps abreast of abort 
mode capability using the NO COMM MODE 
BOUNDARIES cue card, along with calls from 
the MCC. 


ATO procedures during powered flight, with 
the exception of the pre- MECO OMS dump, are 
via the nominal ascent procedures in the ascent 
checklist, which is discussed in Section 7. 


OMS-1 


If possible, ATO abort is declared after MECO 
to ensure that other downmode options are 
available as long as possible. ATO OMS-1 
targets are automatically called up if an ATO is 
declared either pre-MECO or pre-OMS 1. This 
may be a common target set from which either 
an AOA deorbit burn or an ATO circularization 
burn can be performed at OMS-2. The final 
decision can thus be delayed until after OMS-1 
is completed. 


OMS-1 targeting is performed using the same 
procedures and cue cards as AOA. These are 
discussed in Section 6.5. To provide a fuel- 
efficient АТО or AOA burn, OMS-1 is initiated 
at time to apogee (TTA) equals 2 minutes, but 
no earlier than MECO + 2 minutes. 


OMS-2 


The ATO OMS-2 burn is performed using 
nominal Ascent Checklist and cue card proce- 
dures. Proper targets are selected and loaded, 
the shuttle is maneuvered to burn attitude, and 
the burn is executed. 


After completion of both ATO OMS burns, the 
orbiter should be in approximately a 105 n. mi. 
circular orbit. Once this safe orbit is attained, 
mission operations may be continued for at 
least 1 day. Additional burns may be used to 
raise the orbit or the mission may be ended 
early. 


OMS-2 targeting for ATO is very similar to 
AOA, which is discussed in Section 6.5. 
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During ascent, a contingency abort is performed 
when the orbiter's thrust-to-weight ratio is less 
than that needed to achieve a safe orbit or an 
intact abort, due to multiple engine failures. 
The purpose of a contingency abort is to guide 
the orbiter to a safe gliding flight condition, 
where bailout or a landing can be performed. 
Currently, two engine-out contingency aborts 
are automated for both powered flight and the 
entry pullout. Beginning with О1-25 three- 
engine-out contingency aborts were automated. 
The О1-25 software has the capability to be "no- 
opted"; reverting it back to manual contingency 
abort procedures for ET separation and 
maneuver to entry angle of attack until MM 
602. However, this software is not expected to 
be no-opted. Contingency abort procedures are 
very dynamic flight modes that take the orbiter 
to the limits of its structural and flight control 
envelope. For certain cases, especially high 
altitude and low velocity, the resultant entry 
may not be survivable. 


Contingency abort procedures are outlined on 
the Contingency Abort cue cards. These 
procedures are designed to protect the orbiter 
from exceeding certain limits: 


e Q-bar - 800 psf 
• Nz -3.9g 
e Elevon/body flap hinge moments 


The procedures are separated into CONTIN- 
GENCY ABORT and RTLS CONTINGENCY 
cue cards. They are further subdivided into 
event timelines and color-coded for easier use. 
For detailed procedures, the Ascent/Aborts 
Flight Procedures Handbook or the Contin- 
gency Aborts 2102 Manual should be used. 
This section describes the basic information 
applicable to all contingency aborts, and is 
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The PASS is moded to OPS 6 (RTLS) during 
most contingency abort procedures. OPS 6 
provides the entry guidance and flight control 
needed for contingency aborts. The BFS does 
not support contingency aborts because of 
several restrictions, including no single-engine 
roll control, no two- ог three-engine-out 
automated software, and no CSS until post-ET 
separation. 


Powered Flight 


Should two SSMEs fail, the remaining thrust is 
used to reduce entry sink rate. Different proce- 
dures are used, depending on when the engine 
failure occurs. For early failures, when the 
orbiter has a large positive H-dot, the thrust 
vector is pointed toward the horizon to prevent 
further lofting. This increases downrange 
velocity and helps reduce severity of the entry 
pullout. At an inertial velocity between 
approximately 7,000 fps and 12,000 fps, a 
vertical thrust vector is used to counter gravity 
losses, which shallows the flight path angle and 
improves entry conditions. At inertial velocities 
greater than about 12,000 fps, the orbiter may 
have enough energy to continue to a down- 
range site. 


If two engines fail prior to the SE OPS 3 
boundary while the orbiter is within a pre- 
determined velocity envelope, yaw steering of 
45° can be performed for an east coast abort 
landing (ECAL) or Bermuda (BDA) landing. 
High inclination missions use  ECAL 
procedures, while low and mid-inclination mis- 
sions use BDA procedures. ECAL and BDA 
landing sites are available during certain por- 
tions of ascent, should a contingency abort be 
required. ECAL landing sites are strategically 
located along the east coast of the United States. 
These sites are available on missions with 
inclinations greater than 50°. On missions with 
inclinations less than 40° Bermuda is available. 
For due east missions, there is no capability to 
land at Bermuda unless the vehicle is already 
on a TAL abort that crosses the BDA window 
(which is out of plane and north). The yaw 
steering that occurs on these TALs provides the 
plane change required to reduce the entry cross 
range to Bermuda. The velocity for a BDA 
landing is mission dependent but generally 


divided into three major phases: Powered ranges from 9 k fps to 12 k fps for BDA and 6 k 
Flight, ET Separation, and Entry. fps to 12 k fps for ECAL. The powered flight 
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yaw steering for these aborts is open loop. 
There is no range-velocity (R-V) target line 
being attempted, just a reduction in cross range 
to the site. Yaw steering generally increases 
entry pullout loads by approximately 0.1 g. 


Powered flight is also used to dump OMS 
propellant. This reduces weight and moves the 
c.g. forward. Reducing weight decreases the 
peak q-bar during pullout, while more forward 
c.g.’s reduce elevon and body flap deflection 
required for pullout. This helps prevent 
aerosurface saturation and possible actuator 
stall. 


The heads-up roll orients the bottom of the 
orbiter/ET into the velocity vector, which is 
generally the attitude desired for ET SEP and 
entry. 


Three-Engine-Out Automation 


Three-engine-out guidance initiates automati- 
cally when MECO confirmed is set and color is 
displayed on the PFS Ascent/RTLS Traj; no 
item entries are required. If no color is dis- 
played, contingency guidance has determined 
that either an OPS 3 entry or RTLS runway can 
be reached without contingency maneuvering. 
The primary goal is to maneuver to a safe ET 
separation position, separate from the tank, and 
subsequently maneuver to entry attitude via the 
shortest path. The following events occur 
automatically: 


e RTLS abort declaration (if not previ- 
ously selected) 

е Maneuver to ET separation attitude (if 
required) 

® ET separation 

е Post-separation -Z translation 

e Interconnected OMS dump (if required) 

e Inhibit FRCS dump (if required) 

е MM 602 transition 


ET Separation 


Safe ET SEP is a function of alpha and q-bar. As 
the shuttle descends, q-bar increases and ET 
SEP must be performed prior to 10 psf. 


At pressures above 10 psf, the ET may recontact 
the orbiter. Between 2 and 10 psf, the shuttle 
must be at a small negative (about -2°) angle of 
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attack to ensure successful separation. This is 
the same technique used for RTLS ET SEP. At 
less than 2 psf, larger angles of attack are 
acceptable, but the -Z translation is optimized to 
help prevent recontact. 


High sink rates during many contingency abort 
scenarios result in rapid entry into the atmos- 
phere and, therefore, a rapid q-bar buildup. In 
most of these cases, there is not enough time for 
an RTLS-type PPD and a normal mated coast 
separation sequence. A fast SEP is performed 
instead, which takes about 5 seconds. This fast 
SEP can be performed in one of seven ways, 
depending on the vehicle attitude and q-bar at 
the time SEP is required. The first is the imme- 
diate, manually initiated fast SEP where no time 
is available to maneuver to a better attitude. 
The second is an alpha -2 fast SEP where there 
is time to achieve the attitude before q-bar 
exceeds 10 psf. The third is rate fast SEP where 
the separation is commanded while at a high 
angle of attack and a -4° per second pitch rate. 
This technique allows separation to be delayed 
as long as possible and extends the time 
available for powered flight. It is initiated 
when EAS is greater than 10 and increasing (q- 
bar of about 0.7 psf). The ET SEP occurs prior 
to the 2 psf limit for high alpha separations. 
Because the shuttle is near the alpha required 
for entry, the -4° per second pitch rate needs 
only to be slowed as the proper alpha is 
reached. Maneuvering the shuttle to a negative 
alpha for separation would require a second 
pitch maneuver to recover back to the entry 
alpha. 


The pitch rate used for fast SEP is a compromise 
between a rapid pitchdown and the need to 
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maintain control апа slow/reverse the rate after 
SEP. 


The fourth type of fast SEP is (SRB) PC < 50, 
that is used only in first stage when the entire 
stack (SRB and ET) is separated as a whole at 
SRB thrust tail-off. The fifth is an attitude- 
independent SEP where q-bar is low enough to 
allow the separation to occur in any attitude 
with zero rates. The sixth is the alpha 125 
separation, used when high q-bar prevents a 
pitchdown maneuver to alpha -2. In this case, 
the vehicle is pitched up to an alpha of 125° for 
ET separation, then pitched back down to entry 
alpha. Last is the emergency separation, which is 
commanded at KEAS >77 any time the maneuver 
to ET separation attitude fails. This separation is 
commanded immediately when EAS exceeds 77 
knots, regardless of attitude and rates. 


The GPCs will automatically mode to MM 602 
after structural separation, when close to entry 
attitude or >77 KEAS. After MM 602 transition, 
Ма is displayed as Mach number on the AMI. 


Entry 


The powered flight, mated coast, and ET SEP 
portions of contingency aborts are designed to 
deliver the orbiter to acceptable entry conditions 
without loss of control. Entry phases include: 


e Alpha recovery 

е М, hold/ pullout 

e Alpha-Mach 

e ECAL/BDA landing or bailout 


In general, reducing ET SEP altitude and H-dot 
will improve entry conditions. Any errors 
occurring in powered flight or ET SEP will 
result in a more stressful entry. 


Alpha Recovery 


Upon ET SEP completion, the orbiter 15 
maneuvered to an alpha that maximizes lift and 
drag іп а manner similar to GRTLS. The appro- 
priate alpha is a function of Mach number and 
trim but lies in the range of 20° to 58°. 


In some cases, alpha recovery is accomplished by 
stopping the -4° per second pitch rate at the 
appropriate alpha. Because the alpha tape on the 
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AMI pegs at 60°, a maximum alpha of 58° is 
used. 


The body flap and speed brake are set during 
the alpha recovery phase before the critical 
pullout begins. The speed brake and body flap 
affect hinge moment loads on the elevons. A 
body flap versus mach schedule is developed 
for each mission as a function of vehicle weight, 
c.g. and OMS load. The speed brake is left in 
auto unless the М, hold is entered below mach 
three. If below mach three, the crew opens the 
speed brake to 65%. 


Nz Hold/Pullout 


Orbiter H-dot will continue to decrease (more 
negative trend) throughout alpha recovery until 
sufficient q-bar and the resultant lift are 
developed for equilibrium flight. Ав lift 
increases, М, will also increase. When М, = 1.0, 
the orbiter is developing enough lift to support 
its own weight, and H-dot will begin to increase 
(more positive trend). The maximum negative 
H-dot is a good indicator of the severity of the 
entry. It is also used to calculate N. required for 
pullout, using the equation: 


N- target = -H-dot/1000 + 0.65 at М, = 1.0. 


This N; target is calculated by the GPCs and 
displayed on VERT SIT. The №, hold/ pullout is 
flown in AUTO, which significantly increases 
chances of survival. М, target is a compromise 
between structural limits and q-bar limits. The 
structural load factor limit is actually a function 
of orbiter weight and wing root bending 
moment, but the software currently will not 
target more than 3.9 g. Simulator tests show 
that q-bar over 800 psf often leads to loss of 
control. However, this limit is scenario- and 
mission-dependent. 


Load factor continues to increase until within 
approximately 0.4 g of М, target. А pitchdown 
is then initiated to hold М, target. The AMI 
acceleration tape is scaled in g’s in MM 602, 
with 10 = 1 2,20 = 2 g, апа 30 = 3 р. As alpha is 
reduced while holding a constant g, q-bar will 
continue to increase until after the sink rate is 
stopped. When H-dot is positive, pullout is 
complete, and g load is reduced. The crew can 
then mode the body flap to AUTO and monitor 
the alpha/ Mach schedule. 
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The №, hold/ pullout is the most critical phase of 
contingency aborts. Even if flown perfectly, 
some profiles will exceed structural, 
temperature, or flight control limits. Target М, 
must be accurately flown. 


Most regions of the contingency abort profile 
have adequate flight control margins. 
However, there are some regions where even 
flying the maximum structural load factor limit 
during N; hold will not prevent q-bar from 
exceeding 800 psf, possibly stalling the elevons, 
and losing control. 


Flight control gains were designed for a 
maximum q-bar of 375 psf. Loss of control 
results from a number of factors. In some cases, 
aerodynamic moments are so large that the 
orbiter rates cannot be controlled, even at 
maximum  aerosurface deflection and with 
maximum jet firings. Additionally, in some 
cases the aerosurface loads are so large that the 
actuators cannot drive the surfaces. This is 
called actuator stall. Sometimes these control 
problems can be avoided by flying a higher g- 
level during pullout, but the best technique is to 
follow the contingency abort procedures 
explicitly and engage the AUTO system where it 
has the capability to execute critical maneuvers. 


Alpha-Mach 


The crew monitors the alpha-mach phase by 
making sure the vehicle is at the proper alpha 
for the Mach number. This information is in a 
table on the Contingency Abort Entry cue card. 
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Automated ECAL 


Starting with OI-28, Item 1 (centered at the 
bottom of the MM 602 TRAJ) will 
enable/disable the automated ECAL logic. This 
item entry is initialized enabled (ENA) when 
the contingency abort flag is ON, and will 
require no action. 


Entry ECAL energy and g’s will be managed 
with AUTO FCS in OPS 602 and 603 with pitch 
and bank. For automated ECAL, the alpha 
range is 20° to 58°, while the bank range is 0° to 
70°. 


Bailout 


An attitude hold mode in MM 603 allows the 
crew to stabilize the orbiter in gliding flight 
using the AUTO DAP functions. It is armed 
when Mach is less than 1.0, the ABORT MODE 
rotary switch is placed to ATO, and the ABORT 
pushbutton is pressed. 


Guidance snapshots current airspeed and roll 
angle and attempts to hold both constant. The 
crew should stabilize the orbiter at 185 to 195 
KEAS and zero roll angle, then abort MODE 
switch to ATO, press ABORT PBI, and select 
PITCH апа ROLL/YAW AUTO. If a new 
airspeed or roll attitude is desired, select CSS, 
fly to the appropriate parameters, and reselect 
AUTO. 


Once attitude hold is established, a middeck MS 
depressurizes the crew module using the 
emergency vent handle. When cabin pressure 
is equalized, the hatch is jettisoned, the escape 
pole is extended, and bailout is commenced. 
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6.8 SYSTEMS FAILURES 
CONTENTS 


APU/Hydraulics 
Communications 
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Support System 
Electrical Power System 
Guidance, Navigation, and Control .. 
Mechanical 


Main Propulsion System 
Orbital Maneuvering System/ 
Reaction Control System 


Depending on flight phase, various Flight Data 
File documents are used to diagnose, correct, and 
reconfigure malfunctions of orbiter systems. 


e Cue Cards 
e Pocket Checklists 
e Malfunction Book 


e Payload Systems 


Dynamic phases of flight, such as ascent and 
entry, do not allow leisurely identification and 
correction of malfunctions. The CDR and PLT 
flip books, along with the Ascent/Entry 
Systems book are designed to allow quick 
response to certain critical malfunctions in 
order to safe the affected system. 


Procedures in the Ascent, Orbit, and Entry 
Pocket Checklists (PCL) are designed to safe 
critical systems where malfunctions require a 
response in less than 5 minutes. Three separate 
books are used, since actions vary significantly, 
depending upon the flight phase. 


On orbit, with the exception of certain systems 
such as cabin pressurization, most malfunctions 
can be thoroughly investigated and isolated, 
and backup systems can be activated. The 
Malfunction Book provides step-by-step 
procedures that have been developed to allow a 
very structured, methodical approach to 
correcting systems failures. 
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Because each mission is unique, one or more 
Payload Systems procedures will be flown to 
allow the crew to troubleshoot various payload 
malfunctions. 


None of these procedures relieves the crew 
from understanding how various orbiter and 
payload systems work and what failures may 
occur. This in-depth knowledge across a broad 
range of systems allows a well-trained crew to 
be confident that nearly all credible malfunc- 
tions can be handled without compromising 
safety or mission success. 


The philosophy behind all orbiter emergency 
procedures separates into three categories: 


• Detect and confirm the malfunction. 
e Ensure a safe configuration. 


e Attempt to correct the malfunction 
or reconfigure to optimize remaining 
systems. 


Many orbiter malfunctions are accompanied by 
some type of caution and warning alarm. These 
are designed to help the crew identify the 
system involved and direct them to the correct 
procedure. Almost all emergency procedures 
titles reflect either a hardware caution and 
warning light or a software fault detection 
annunciation (FDA) message. It is extremely 
important to confirm the malfunction with 
whatever data is available. Sources of data may 
include dedicated displays, related system 
malfunctions, or an inventory of failed equip- 
ment. Mission Control is often able to provide 
confirmation, since a great deal more data is 
available on the ground, and highly trained and 
knowledgeable controllers are dedicated to each 
system. 


Malfunction confirmation may be complicated 
by previous failures. Also, the caution and 
warning system cannot distinguish real failures 
from sensor failures. Thus, identification of the 
malfunction and selection of the correct proce- 
dure are sometimes difficult. Only through 
study, training, and practice in simulators can 
crewmembers develop the capability to quickly 
and accurately detect and confirm malfunctions 
in a vehicle as complex as the orbiter. 
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Once a malfunction has been identified and the 
proper procedure selected, the crew takes 
certain well-defined steps to put the orbiter into 
a safe configuration. An example is pressing 
the appropriate MAIN ENGINE SHUT DOWN 
pushbuttons after a second engine failure to 
establish single engine roll control. Due to the 
redundancy of most onboard systems, no 
immediate action should be required for most 
single and many dual failures. However, if 
multiple failures occur, there may be very little 
time to switch to alternative systems or take the 
necessary steps to prevent loss of control. In 
multiple failure cases, the crew must keep in 
mind the interaction of different systems and 
prioritize their responses. 


Most malfunction procedures involve correcting 
a malfunction to recover lost capability or 
remaining systems. In general, switching to 
backup systems, interconnecting to components 
of other systems, or securing some remaining 
systems to reduce heat loads or power 
consumption are methods used by the crew. 


On orbit, it may be possible to perform in-flight 
maintenance (IFM) to install replacement 
components or reconfigure systems. An IFM 
Checklist covers many of these pre-planned 
activities. A dedicated team of IFM specialists 
supports each mission and responds to MCC in 
the event an IFM procedure is contemplated. 
Mission Control also excels at developing new 
procedures in real time to deal with unexpected 
malfunctions. This capability is frequently 
exercised during simulations. 


This section discusses malfunction signatures 
and confirming cues for some of the 
malfunctions that may be encountered during 
training and in flight. Brief summaries of actions 
required for safing and reconfiguration are also 
presented. For more detailed malfunction 
information, refer to Flight Data File books, 
Flight Procedures Handbooks, and System 
Workbooks. 


APU/Hydraulics 


The APU/HYD cue cards and PCL are used to 
provide response to APU and HYD malfunc- 
tions. During ascent, actions are taken to 
protect the main engines. Unless the APU or 
hydraulic failure could cause a catastrophe, the 
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system will not be shut down until after MECO 
to avoid interrupting hydraulic power to the 
main engines. Loss of a hydraulic system in 
powered flight will result in an SSME hydraulic 
lockup. Loss of two hydraulic systems in 
powered flight will result in two SSME 
hydraulic lockups, one of which will have no 
thrust vector control (TVC). Both cases would 
then involve а рте- МЕСО SSME shutdown. 


APU Failure 


e Pressure decrease on both the SPEC 
page(s) and HYD/APU display 
(independent sensors) 


e APU speed goes to zero 
e APUSPD HI/LOW message 
е MASTER ALARM 


e APU OVERSPEED/UNDERSPEED light 
on F7 


e Accumulator pressure decrease to ~2600 
psia 


е HYD PRESS light on F7 


To safe the system, the crew performs the APU 
SHUTDOWN procedures to remove the start 
command, close fuel tank isolation valves, and 
remove power from the APU controller. The 
remaining APUs may be taken to high speed 
and auto shutdown inhibited, depending upon 
flight phase. 


If APU shutdown was due to an underspeed, a 
restart may be attempted after completion of the 
APU COOLDOWN procedure. An APU that 
shut down due to a confirmed overspeed will 
never be restarted. Only MCC can identify a false 
overspeed, which would be a candidate for possible 
restart. 


Hydraulic System Failure 


e Pressure decrease on both the SPEC 
page(s) and HYD/APU display 
(independent sensors) 


e APU speed good 
e MASTER ALARM 
e HYD PRESS light 
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е HYD PRESS message 


e Accumulator pressure drops to ~2600 
psia 


Two of the three pressure sensors in each 
hydraulic system can be seen onboard. MCC 
receives data from all three sensors. Ш the 
hydraulic failure is confirmed, the APU will be 
shut down to prevent additional damage. The 
remaining APUs may be taken to high speed 
and auto shutdown inhibited, depending on 
flight phase. 


Partial hydraulic failure due to a degraded 
pump or line blockage may produce pressure 
fluctuations. For ascent, the system is allowed 
to operate as long as sufficient pressure is 
available to keep a main engine from going into 
hydraulic lockup (~1500 psi). During other 
flight phases, the hydraulic system is taken to 
low pressure in an attempt to restore stable 
operation and to ensure that the aerosurface 
switching valve has selected a “good” hydraulic 
system for aerosurface actuation. If the system 
is stable in low pressure, the APU is kept 
running until an appropriate shutdown time. If 
the system is required for critical functions such 
as landing, the system may be returned to 
normal pressure. 


Hydraulic Leaks 
е Unexpected drop in reservoir quantity 
® SM ALERT 
e SM2 HYD QTY message 


During powered flight, the system is left in 
normal pressure to prevent SSME hydraulic 
lockup. At other times, the system is taken to 
low pressure to reduce leak rate. Normal 
pressure may be reselected if required. MCC 
determines leak rate and decides whether or not 
the system may be returned to normal pressure. 


APU Fuel/Nitrogen Leaks 
e Unexpected decrease in fuel quantity 
е SM ALERT 
® SM2 APU FUEL QTY message 
e Difference in fuel quantity among APUs 


e Decrease in fuel pressure 
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Since fuel and nitrogen leaks are indistinguish- 
able until very low levels are reached, crew 
response is to assume a fuel leak (worst case). 
No action is required pre-MECO unless the 
APU shuts down. For other flight phases, the 
APU is shut down and the fuel tank isolation 
valves closed to attempt to isolate the leak. If 
isolated, the APU is only started for critical 
operations. If non-isolatable, the APU is 
restarted and run to fuel depletion. This pre- 
vents damage in the aft compartment from 
leaking hydrazine, which is very corrosive. 


Water Quantity Low 


e Abnormal decrease in water boiler 


quantity 
e SM ALERT 
е SM2 W/B QTY message 


Water spray boiler nitrogen or water leaks, as 
well as excessive spraying by a faulty water 
spray boiler controller or a faulty sensor (used in 
the PVT calculation) can cause ап abnormal 
decrease in water boiler quantity. 


MCC can detect excessive spraying, but in any 
case, the crew should switch to the alternate 
controller. Ш switching controllers does not 
work, boiler power is cycled to reduce water 
usage. MCC will determine when and if APU 
shutdown is required, depending on mission 
phase. 


For a water leak, switching controllers will not 
help, and APU cooling will be lost when the 
quantity reaches zero. Тһе APU will then 
overheat within 4 minutes. Nitrogen leaks allow 
cooling for a short time even after water quantity 
reads zero. W/B QTY is a PVT calculation. 


APU Shifts to High Speed 


® APU rpm increases to 113% 

е APU SPD HI Fault message 

е SM ALERT 
An APU shift to high speed can be caused by an 
APU controller electronic malfunction or an 
open failure of the Primary Control Valve. The 


crew will take APU control to high-speed to 
ensure proper controller logic for high-speed 


6. EMERGENCY PROCEDURES 


6.8 Systems Failures 


USA007587 
Rev. A 


control. The APU will be shut down as soon as 
possible post MECO as long as two other APUs 
are working properly. APU auto shutdown 
must not be inhibited on an APU that has 
shifted to high-speed since auto shutdown via 
the fuel tank isolation valves is the only 
protection from APU overspeed if both control 
valves were to fail open. 


Hydraulic Fluid/Lube Oil Overtemp 


e High hydraulic fluid temp 
e High lube oil temp 

e MASTER ALARM 

e APU TEMP light on F7 

е SM ALERT 

е APU TEMP message 

® HYD RSVRT message 


Excessive hydraulic fluid temperature (>230° F) 
or lube oil temperature (>290° F) are signatures 
of inadequate cooling. This may be caused by 
mechanical problems or a water spray boiler 
malfunction. The crew should switch boiler 
controllers first. If APU temperatures decrease, 
the problem was in the controller. If 
temperatures continue to rise, APU shutdown 
may be required. 


Shutdown and restart may be possible if the 
APU 15 required for critical maneuvers. 
Although the system is not limited in run time 
for excessive hydraulic temperatures, the 
system may be taken to low pressure or 
shutdown in order to maintain the hydraulic 
fluid below limits that may cause system seal 
degradation if exceeded. 


Priority Rate Limiting 


• Possible differing hydraulic pressure оп 
SPEC page(s) and HYD/APU display 


® SM ALERT 
e PRL DLMA message 


e APU accumulator pressure 


e APU speed 
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Pressure (or sensor) differences within a 
particular hydraulic system may cause the PRL 
software to be confused. MCC can see all three 
sensors in each hydraulic system and will assist 
the crew with proper actions. The first action is 
to use confirming cues to determine if the APU 
is running. Once APU status is known, the 
crew should verify all good systems are selected 
for PRL by executing appropriate item entries 
on the OVERRIDE (SPEC 51) display. 


Switching Valve Failure 
• MCC call 


• Control problems 


This failure can prevent the hydraulic systems 
from operating a control surface. The crew can 
cycle the affected system hydraulic pressure 
between LOW and NORM to attempt to reset 
the valve upon MCC direction. The other 
option is to deselect one or more hydraulic sys- 
tem in the PRL software and operate on 
reduced PRL rates. This will reduce the loads 
on the good APU(s). This procedure is also 
performed only at MCC direction. 


Uncommanded Brake Pressure 


e Brake pressure greater than zero in 
flight 


е SM ALERT 
e SM0 BRAKE P message 


Since brake pressure is measured downstream 
of the brake/skid control module, there is no 
way to determine which hydraulic system is 
responsible. Landing with pressure greater than 
200 psi in the braking system can cause the 
wheels to be locked at touchdown. This will 
cause one or more tires to fail, resulting in 
directional control problems and possible loss of 
control. Nominally, none of the three brake 
isolation valves will be open prior to weight on 
wheels (WOW) or main gear touchdown. 
Therefore, there should be no concern for this 
problem. However, if the hydraulic system 2 
brake isolation valve must be opened prior to 
WOW for nose gear deploy redundancy, there is 
potential to get uncommanded brake pressure. 
To correct this problem, the PLT must close 
brake isolation valve 2 as soon as possible after 
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gear deploy and before WOW. This will allow 
for the pressure to bleed down. 


The crew should close the appropriate isolation 
valves, then reopen them after nose gear touch- 
down. Since hydraulic system 1 supplies power 
for nosewheel steering, this procedure is 
modified for certain cases, and isolation valve 1 
is reopened at main gear touchdown. 


Communications 


The orbiter communications system is extensive 
and complex. A great deal of redundancy 
exists, and the system has been very reliable. 
For normal operations, MCC commands system 
reconfigurations. Loss of communication can 
occur for reasons other than onboard 
equipment, such as ground station or satellite 
problems and antenna blockage. The crew 
should consider this possibility as well as 
their current communication mode, comm 
panel configuration, and position over the 
ground prior to executing lost communication 
procedures. 


ICOM Lost 


e Inability to communicate using ICOM 


The procedure for ICOM lost will have the 
backup audio terminal unit (ATU) selected via 
the POSITIONS control switch. Positions with 
backup ATU include commander (CDR/left), 
pilot (PLT/right), mission specialist (MS), and 
airlock (AL). At other positions, or if alternate 
position doesn't regain ICOM, the alternate 
audio central control unit is selected via panel 
СЗ. If these actions do not regain ICOM, а 
different ATU, crew communications umbilical 
(CCU) connection, or headset/handheld mic 
may be required to regain ICOM. 


Comm Lost 
® ICOM operating properly 
e S-band comm lost on multiple panels 


e UHF comm status 


The crew should first select ACCU alternate 
power. If this is unsuccessful, S-band PM panel 
C3 controls are verified and the crew switches 
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the S-BAND PM CONTROL switch to PANEL, 
then back to COMMAND. This causes the S- 
band PM system to attempt to operate as 
specified by the panel A1L switches. If this 
corrects the problem, one of the originally 
selected S-band subsystems has malfunctioned. 


CAUTION 
Panel A1L switches must be set up for the 


current comm mode (including proper NSP 
configurations). 


To troubleshoot antenna problems, manual 
antenna selection is attempted, using the 
SIGNAL STRENGTH meter and SM OPS 201 
ANTENNA display. If comm is not restored, 
the ANTENNA rotary switch on panel C3 is 
returned to GPC. 


Finally, the procedure provides steps to deter- 
mine if MCC can uplink to a GNC GPC for state 
vector updates. If there is no uplink, the crew 
may have to deorbit without MCC direction to 
preserve IMU alignment entry limits. If there is 
uplink capability to the vehicle, an in-flight 
maintenance procedure is available to bypass a 
completely failed ACCU. 


ПНЕ Lost 


e Unable to communicate on UHF 


The crew first turns off the UHF squelch system 
to ensure good signal reception, then an 
alternate ACCU power source is selected. 


Three frequencies are available (259.7, 296.8, 
and GUARD). All should be tried. GUARD is 
an international UHF frequency that is only 
used in emergencies. 


Since the UHF antenna is located on the 
orbiter’s belly, a roll to heads up is performed to 
ensure optimum antenna gain. 


Finally, the UHF power amplifier is turned off. 
If successful, a low power transmit mode will 
be available. 
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Cryo 


The cryo O2 and H2 systems provide reactants 
to the fuel cells from tanks under the payload 
bay. The cryo O2 system also supplies oxygen 
to the crew module for metabolic use and for 
direct breathing while using the LES helmets. 


Leaks 


e MASTER ALARM 

• O2 (H2) PRESS light (F7 matrix) 

е SMALERT 

е CRYO C2 (H2) МАМЕ message 

• CRYO C2 (H2) PRES message 

® Decreasing tank pressure 

e Decreasing manifold pressure 

® МСС call 
If a cryo leak is detected, its location must first 
be determined, then steps must be taken to 
isolate the leak. If pressure decreases in only 
one tank, a tank leak is indicated. Check valves 
should prevent the other tanks from losing cryo 
through a leaking tank. Some cryo in the 


leaking tank may still be usable, depending on 
the leak rate. Mission duration may be affected. 


A pressure decrease in all tanks requires closing 
the manifold isolation valves to isolate the leak. 
Once a potential leak area is isolated to a single 
manifold, additional troubleshooting may allow 
further isolation to either the PCS system or an 
individual fuel cell. Should the leak be in the 
manifold feeding a fuel cell or in the fuel cell 
itself, a shutdown and powerdown may be 
required. Mission duration may be affected, 
depending on leak location and the mission 
cryo quantity requirements. 


Heater Problems 
е MASTER ALARM 
• O2 (H2) PRESS light (F7 matrix) 
® O2 HEATER TEMP light (F7 matrix) 
e CRYO C2 (H2) PRES message 
® CRYO O2 НТК message 


e High tank temperature 
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e High tank pressure 
e High heater temperature 


Cryo heaters can fail on or off. A heater can 
also have a short. If an O2 heater has a short, it 
should cause the O2 current sensor logic to trip 
and disable the heater. 


A failed “on” heater may result in high tank 
temperature or pressure, requiring the affected 
heater to be turned off. A failed “off” heater 
can be a control problem or a failure of the 
heater itself. MCC normally alerts the crew to 
these conditions. Redundant heaters are used if 
there is a heater problem. For control problems, 
a manual heater control procedure can be used. 


Failure of heaters in two tanks indicates a 
paired logic problem. For this case, each tank’s 
heaters must be operated individually 10 
determine the location of the failure. 


Data Processing System 


Hardware and software DPS problems are 
normally detected by monitoring software and 
annunciated by the C&W system. Failure 
signatures are shown in a table in this section. 
Once the failure is identified, the appropriate 
procedure is worked. The impact of a single 
DPS failure in other systems is normally a loss 
of redundancy rather than a loss of capability. 


Key safing steps in each procedure are used to 
prevent commands to good systems from bad 
computers and prevent good computers from 
using data from bad components. To correct 
transient errors, an I/O RESET or power cycle is 
attempted. For port-dependent failures, the 
port mode procedure may allow communica- 
tions to be resumed using alternate ports and a 
different data bus. 


During ascent or entry, when certain DPS 
failures affect more than one flight-critical 
string, the MULTI DATA PATH cue card is 
used to identify failure effects and determine 
crew actions. For some multiple failures, when 
Flight Rules allow, the DPS can be reconfigured 
using the RESTRING cue card. This procedure 
allows good GPCs to take over flight-critical 
buses and components that are lost after one or 
more GPC failures. 
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FAILURE 


Fail to Sync 


Fail to Halt 
Fail to Quit 


PASS Total Set 
Split 


Generic PASS Fatal 
Software Error 


МО Term B fails on 


1О Term A fails on 


МОМ ГО Error at 
MDM 


MDM I/O Error at 
GPC 


Component 
problems 


OI MDM/DSC Fail 


| | caUTION@ WARNING | & WARNING 


HARDWARE SOFTWARE 


GPC light GPC Fail message 

CAM lights Down arrow on SYS SUMM 
Failed GPC issues fail messages 
against the good GPCs 
GPC continues to drive its IDP 


BP Output tb 
BP Mode tb 
CAM lights 
GPC light 
Big X 

Poll Fail 


GPC Fail message 
Down arrow on SYS SUMM 


GPC light 
CAM lights 
Big X 

Poll Fail 


GPC Fail message 
Down arrow on SYS SUMM 


All PASS GPCs stop talking to each other, each GPC 
issues fail messages against the others, diagonal 
CAM lights lit, BFS standalone 


Fail to quit or halt on all four GPCs simultaneously/all 
PASS driven IDPs Big X and poll fail/BFS standalone 
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PROCEDURE COMMENTS 


GPC Fail GPC continues to run and 


send commands over the 
GPC Fail 


data buses 
GPC Fail 
BFS Engage 


Mode tb will be RUN and 
Output tb is grey 


Dead GPC, no commands 


Like fail to halt, except Mode 
and Output tb’s do not turn 
barberpole (BP) 


Engage should be done with 
10 sec for Ascent, 45 sec 
for Entry 


Engage should be done 
within 10 sec for Ascent, 


BFS Engage 


45 sec for Entry 


omm. 


Bp Output tb 
Bp Mode tb 
Big X 

Poll Fail 


Bp Output tb 


Varies with MDM 


Varies with MDM 


Varies with 
component 


Varies with 
MDM/DSC 


GPC Fail message 
Down arrow on SYS SUMM 


Down arrow on SYS SUMM 
for FF and FA 
FF and FA I/O Error messages 


Down arrow on SYS SUMM 
for PL1 and PL2 
PL1 and 2 I/O Error messages 


1О Error message (PASS & 
BFS) Down arrow on 

PASS SYS SUMM 
Down arrow on BFS SYS SUMM 


PASS I/O Error message 
BFS BCE String PASS message 
Down arrow on PASS for 
failed MDM 
M's on BFS SYS SUMM 
for FF and FA 


BCE String x message 
M's on PASS and BFS SYS 
SUMM 


М 5 on SYS SUMM for MDM 

L’s on SYS SUMM for DSC 

ПО Error PCM annunciated by 
BFS for PCM port problem or 
MDM problem 

PASS SM machine will 

annunciate S62 BCE BYP OFX 

or OA message 


Like fail to halt, but no CAM 
lights or F7 GPC light 


GPC Fail 
GPC Fail 


BFS or SM 
GPC Fail 


MDM ИО Error 
MDM ИО Error 


BCE String X 


МО Error PCM 


GPC running, but 
commands inhibited on 
flight critical data buses 


GPC running, but 
commands inhibited on 
payload and launch data 
buses 


GPC good, MDM lost 


Port mode may recover 


Port mode will cause loss of 
other MDM on string 
(trade-off case) 


Use Ref Data book to find 
parameters lost and verify 
signature 


DPS Failure Signatures 
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Set Splits 


Since the GPCs run in a redundant set during 
ascent, entry, and some on-orbit operations, it is 
possible for one or more PASS GPCs to split 
apart from the rest of the set and continue 
running. Various combinations are possible, 
but in all cases it is imperative to determine if a 
good PASS set exists. A good set must include: 


e 1IMU 

e 2RGAs 

e 2 AAs 

• 2 ЕС5 channels 


Restring ог BFS engage is required if a good set 
does not exist. 


NOTE 


See section 6.9 for GPC set splits during 
ascent. 


BFS Engage 


For unrecoverable PASS failures, the BFS is 
available to take over orbiter control. Monitor- 
ing of BFS and GNC systems status prior to 
engage is required to ensure the BFS is capable 
of control. For a successful BFS engage, the BFS 
must have a good nav state and be able to 
communicate with/command: 


e 1IMU 

e 1 КСА 

е 1АА (for 1% stage) 
e 2FCS channels 

• ТАРТА 


BFS Failures 


For most transient software failures, the BFS 
will automatically attempt a software restart. If 
this is successful, operations will continue, and 
a GPC BITE message will be issued. A Halt 
transient results in the BFS restarting in OPS 0, 
and it must be moded to the appropriate OPS 
by the crew. For these transient failures, 
however, the BFS should be considered 
“suspect” for engage. This means that it should 
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only be engaged for emergency situations for 
total PASS failures. 


Total BFS GPC failures present a signature similar 
to a PASS GPC FAIL. The crew should see 
barberpole OUTPUT and MODE talkbacks, a big 
X on the BFS IDP, and a POLL FAIL message. 


Actions for BFS failures are listed in the 
appropriate FDF procedures. Since the BFS also 
controls several systems during ascent and 
entry, the crew may be required to take manual 
control of communications or ECLSS equip- 
ment. The following table lists some commands 
issued by the BFS: 


COMM 


antenna | ops. 6.3 


Other SPCs to 
ШШЕ Stations for 


Ops 1,6,3 


BFS Commands Over Payload Buses 


Environmental Control and Life Support 
System 


Environmental control and life support system 
(ECLSS) malfunction procedures cover the four 
subsystems of pressurization, air revitalization, 
active thermal control, and supply/waste 
water. Since the ECLSS is highly redundant, 
the normal response to failures is to switch to 
the alternate system. 


Cabin Pressure 
е Klaxon 
e MASTER ALARM 
e Cabin pressure meter 
e dP/dt meter 
• SM SYS SUMM 
® High O2 ог №2 flow 
e CABIN ATM light (F7 matrix) 


Crew reaction to cabin leaks consists of four basic 
steps: assess magnitude of the leak, attempt leak 
isolation through system reconfiguration, power 
down, and prepare for deorbit. 
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The crew first closes cabin relief isolation valves 
and uses available data sources (DPS displays 
and meters) to verify the leak. If a leak is 
confirmed, the leak rate determines whether an 
ascent abort or an emergency deorbit is 
required. If enough time is available, additional 
leak isolation procedures are attempted. 


An unexpected cabin pressure increase could be 
caused by either a PCS leak or a malfunction in 
the PCS control system. Flight Data File pro- 
cedures are used to secure the PCS and isolate 
the failure. An early deorbit may be required 
for a non-isolatable leak to prevent O2 or N2 
depletion. PCS leaks may be either internal or 
external to the crew module. 


Pump/Fan Failures 
е Rapid drop in flow rate 
e Pressure differential in loop 
e Rising temperatures 
e MASTER ALARM 
e Hardware caution and warning 


e Fault messages 


The normal response is to switch to an alternate 
pump/fan. However, during powered flight, 
only critical equipment will be swapped, 
typically during post MECO. The Freon pump 
and isolation valves are the most likely AC 
powered equipment to be swapped to prevent 
an abort. This avoids AC electrical transients, 
with possible loss of the engine controllers. 
Should avionics bay temperatures exceed limits, 
activation of the alternate water loop is 
permitted. 


Water/Freon Leaks 
• Decrease in flow rate 
e Change in accumulator pressure 
e Decrease in pump delta pressure 
e MASTER ALARM 
e Hardware caution and warning 


e Fault messages 
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Depletion of fluid makes the loop unavailable 
for cooling. An early deorbit should be ex- 
pected. On ascent, an abort may be required for 
the loss of two Н2О loops or two Freon loops. 


Fire 
e Siren 
e Master alarm 
е SMOKE DETECTION lights on panel L1 
e Fault messages 


• Smoke concentration on DPS display 


If a fire is confirmed by checking the smoke 
concentration on the DPS display, the crew 
must protect themselves with quick-don masks 
(QDMs) if on orbit or by closing their visors and 
going on suit O2 if during ascent or entry, then 
taking steps to extinguish the fire. Either a 
built-in or a portable Halon bottle is discharged 
to extinguish the fire. 


Once the fire is under control, the WCS charcoal 
filter, ATCO, and LiOH canisters are used to 
clear the cabin atmosphere of combustion 
products. If the crew cannot purify the 
atmosphere to a safe level, then an early deorbit 
will be required, since the orbiter N2 supply is 
insufficient to maintain cabin PPO2 below 
flammability limits for more than 4 to 8 hours 
while the crew is wearing helmets and exhaling 
oxygen-rich air. 


Cooling Loss 


Loss of one or more heat rejection systems 
(radiators, FES, NH3 boiler) requires a recon- 
figuration to make up for lost cooling capability 
while troubleshooting. A powerdown may be 
required. For severe cooling loss, an early 
deorbit may be performed. 


Electrical Power System 


The orbiter EPS configuration during all flight 
phases is for all buses to be powered and 
operating independently. Payload and other 
considerations may mandate bus ties during orbit 
operations. EPS malfunctions that require an 
immediate response include reactant valves, fuel 
cells, major DC buses, DC-AC inverters, and| 
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AC motors. Cryo-related problems are discussed 


in the Cryo section. 


Shorts 
e High amps 
e Low volts 


e Hardware caution and warning (F7 
lights) 


е MASTER ALARM 
e Fault messages 
e DPS displays 


e F9 meter 


For a confirmed short, power is removed from 
the affected bus. Circuit protection equipment 
built into the orbiter may also react to large 
shorts by tripping RPCs, blowing fuses, or 
popping circuit breakers. 


Most bus shorts are characterized by high 
current and low voltage. Each bus failure has a 
particular signature that should be learned 
through practice in failure recognition in the 
Single System Trainer (SST). It is important to 
be able to react quickly and correctly to 
electrical shorts, particularly during critical 
flight phases. 


CAUTION 


Never tie a good bus to a shorted bus while 
executing malfunction procedures. 


Bus Losses 


e Bus loss ID in FDF 
e Fault messages 


e Hardware caution and warning 


The following table is an abbreviated list of cues 
for certain bus losses. When the bus loss is 
confirmed, an attempt may be made to recover 
the bus, depending on flight phase, criticality, 
and the type of failure. If the bus cannot be 
regained, FDF bus loss actions must Бе 
completed to reconfigure and safe systems. 
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MAST ALARM 

Hardware caution & warning MAIN BUS 
UNDERVOLT light and other lights on F7 
matrix 

Fault messages 

MN volts = 0 

IDP loss 

FC amps = 0 

MASTER ALARM 

Hardware caution & warning AC VOLTAGE 
light, FUEL CELL PUMP light 

Fault messages 

AC volts = 0 

AC amps = 0 

MN volts good 

IDP loss 

Pump/motors 


MASTER ALARM 


Hardware caution & warning 

Fault messages 

ESS volts low 

Bus loss ID 

FUEL CELL PUMP light on F7 matrix 


CNTL Control bus losses are difficult to diagnose. 
The signature could range from no 
indications to: 

SM Alert 

Fault messages, including 
SM CNTL/ESS V 

CNTL volts low 

Bus loss ID 


Panel/ Equipment loss 
Sub bus Bus loss ID 


Abbreviated Bus Loss Signatures 


AC MASTER ALARM 
Hardware caution & warning AC VOLTAGE 
light, other F7 lights 
Fault messages 
AC volts low 
AC amps low 
Pumps/motors 


Fuel Cell Reactant Valves 


е MASTER ALARM 

® SM ALERT 

e FUEL CELL REAC light on panel F7 
е FC REAC message 

e FC COOL P message 


If a reactant valve failure annunciates, the PLT 
should quickly attempt to reopen the valve and 
bus tie in order to prevent fuel cell loss and a 
subsequent main bus loss. For confirmed 
reactant valve failures, the affected fuel cell 
must be shutdown. If an O2 or H2 reactant 
valve fails closed, the fuel cell will fail from lack 
of fuel within as little as 20 to 30 seconds, 
depending on vehicle loading and cryo quantities. 
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Fuel Cell Cooling Loss 


e MASTER ALARM 

e FUEL CELL PUMP light (F7 matrix) 

е FC PUMP message 

е FCcoolant pump AP talkback barberpole 


Fuel cell cooling can be lost for several reasons, 
including: coolant pump failure, AC bus loss, 
ECU failure, ESS bus loss, or a fuel cell coolant 
leak. The fuel cell temperature signatures vary 
with each failure, but in general, the fuel cell 
must be secured within 9 minutes to prevent 
stack overheating. To troubleshoot fuel cell 
cooling problems, use the following rules of 
thumb, although each is not applicable in all 
cases. 
• If the coolant pump is not running, EXIT 
T should increase if the H2 pump is 
running. 


® If the coolant pump and the H2 pump are 
not running, STACK T will decrease. 
EXIT T will increase slightly and stabilize. 
(Sensors are not reliable for the actual FC 
Temperature without any flow.) 


e Combined coolant/H2 pump failures 
may be an indication of an ECU mal- 
function, or an AC problem affecting 
both motors. 


® Steadily increasing STACK T and EXIT 
T are indications of a real fuel cell cool- 
ing problem. 


Fuel Cell Internal Short 


e Low fuel cell volts 

e Low MN volts 

е Reduced ЕС amps 

* Increasing STACK T 

е Increased reactant flow 

• Fuel cell performance degraded 
For this case, the MN BUS UNDERVOLT 
procedure is used. The fuel cell is shut down 
after dropping the affected bus. For а 
confirmed fuel cell short, the main bus may be 


regained using the BUS TIE procedure. (Long 
form, volts «20.) 
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Fuel Cell Crossover 


е SM ALERT 
е FCDELTA У message 
e Increasing STACK T and EXIT T 


e Decrease in FC volts 


The FC DELTA V procedure is used to bus tie 
and safe the fuel cell. 


Fuel Cell Shutdown 


If a shutdown is required due to a failure 
or malfunction, the FC SHUTDOWN procedure 


is used. Upon completion, the appropriate 
LOSS OF 1 ЕС powerdown should be 
performed. 


Should a second fuel cell shutdown be required, 
the 2ND FC SHUTDN procedure is used. In 
this case, some powerdown is required prior to 
fuel cell shutdown to prevent excessive loads on 
the single remaining fuel cell. During ascent, 
one FC cannot support the load of three main 
buses, so one main bus will have to be dropped. 
As before, a LOSS OF 2ND FC powerdown 
would be performed after the fuel cell is 
shut down. 


Dual Gas Regulator 


e SM ALERT 
• FC COOL P message 


е Reduction or increase in coolant loop 
pressure 


Pressure that is either too high or too low will 
cause the fuel cell to operate incorrectly, and a 
shutdown will be required. The BUS TIE 
procedure is used to prevent loss of an MN bus. 
Time available before shutdown of the fuel cell 
varies depending upon the severity of the 
pressure problem. 


Powerdowns 


Powerdowns are performed to reduce electrical 
power consumption and reduce heat loads. The 
appropriate ascent, orbit, or entry FDF 
procedure is used. These procedures are 
designed specifically for each flight phase. 
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Guidance, Navigation, and Control 


The most serious failures in GNC systems are 
those that affect flight control. It is imperative 
that the crew manage channels for the flight 
control system. Failures in the flight control 
systems can rapidly deteriorate into a loss 
of control. 


FCS Channel 


e MASTER ALARM 

e FCS CHANNEL light on panel F7 
e FCS CH message 

• Down arrow on СМС SYSSUMM 


e Down arrows on SPEC 53 CONTROLS 
display 


e MCC call 


Due to system redundancy, no action is 
required for the first failure. A second failure 
on the same effector requires the crew to place 
the remaining channels to OVERRIDE. This 
prevents a good channel from being bypassed 
in the event of a third failure. 


Sensor Failures/Dilemmas 
e SM ALERT or Master Alarm 
e Fault message 


e Down arrow, “?,” or M on GNC SYS 
SUMM 


e Down arrow, “?,” or М on sensor 


displays 


For single sensor failures or commfaults, 
redundancy should allow the good systems to 
continue to provide data without impacting 
control system performance. A second or third 
failure may confuse the selection filter, 
requiring crew intervention. MCC сап 
generally resolve sensor dilemmas quickly, 
using the additional data available in the 
telemetry stream. 


Mechanical 


Malfunctions in orbiter mechanically actuated 
systems such as payload bay doors and latches 
can be electrical, mechanical, or DPS related. 
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Since many of these systems are critical for 
entry, it is important to understand each system 
and troubleshoot correctly. 


Motor Failure 


All orbiter mechanical systems have two motors 
for redundancy, and all systems can drive with 
just one motor. Motor failures can occur due to 
power failures, control logic failures, software 
failures, or jams. Failure of a single motor 
doubles actuation time for the system. Failure 
of both motors precludes actuation. 
Workarounds, IFM, and, as a last resort, EVA 
procedures are available to restore capabilities 
on some systems. 


Indicators 


Microswitch failures can prevent automatic 
system operation or give false indications 
of a malfunction. Individual readouts of 
paired microswitches on most mechanical 
systems allow the crew or MCC to determine 
actual status of the system and its associated 
talkback indicators. 


Main Propulsion System 


MPS failures during ascent can cause degraded 
performance that may result in ап abort. 
Most cue card procedures must be executed 
quickly to safe systems and protect against 
additional failures. Close crew coordination is 
required, especially where an ascent abort must 
be executed. 


Engine Failure 


e MASTER ALARM 


е Red MAIN ENGINE STATUS light on 
panel F7 


» SSME FAIL message 
e Pc goes to zero 
е Change in acceleration 


• Reduced helium flow. (Helium flow 
increases during shutdown and then 
decreases to zero post shutdown) 


е MCC call 
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The most important step following ап engine 
failure is to ensure the GPCs know that an 
engine has failed. This is checked by verifying 
that an SSME FAIL message has annunciated. 
If the SSME FAIL message has not been 
annunciated, the crew must push the 
appropriate MAIN ENGINE SHUT DOWN 
pushbutton to mode guidance. 


For any SSME failure, the PLT places the AC 
BUS SENSOR switches to the off position. This 
prevents the AC bus sensors from erroneously 
taking an AC bus offline, which would impact 
the engine controllers of the remaining engines. 


Helium Leak 


e SM ALERT 

® MPS HE message 

е HE dP/dt > 20 

e Down arrow оп BFS СМС SYS SUMM 1 


e HE tank pressure lower than other 
engine tanks 


е HE Reg AT or BT (may be present) 


Early in ascent, a cue card isolation procedure is 
used to secure one helium leg at a time. If the 
leak is isolated, the bad valve is kept closed and 
MCC evaluates the remaining helium to 
determine if a safe shutdown will occur at 
MECO. It may be necessary to interconnect the 
pneumatic helium system.  Failures later in 
ascent may require a shutdown using the 
shutdown pushbutton only if there is 
insufficient time for leak isolation. A 
pushbutton shutdown requires less helium than 
a pneumatic shutdown, since hydraulic 
pressure is used to actuate some SSME valves. 


If a leak cannot be isolated, helium from a 
previously failed engine may be used as a 
source of additional helium to prevent a second 
engine failure. The engine will fail when 
helium is depleted. Limits must be enabled to 
ensure a safe shutdown. An early crew- 
initiated shutdown could also be required, 
depending on leak rate. MCC will analyze leak 
rate and recommend action if comm is avail- 
able. Without comm, the crew uses the proce- 
dures on the MPS cue card. 
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Data Path Failure 
e Engine Pc goes to zero 
e SM ALERT 
® SSME DATA message 


e Amber MAIN ENGINE STATUS light on 
panel F7 


e Acceleration cues 
e Helium flow 


e MCC call 


The onboard software automatically inhibits 
limits for a data path failure. If the engine is 
still running, the crew re-enables limits and 
should assume a command path failure also 
exists (which requires a pre-MECO engine 
shutdown), unless told otherwise Бу MCC. Ш 
the engine has failed, the shutdown pushbutton 
must be pressed to mode guidance for the 
engine failure. 


Stuck Throttle 


e SM ALERT 


e Amber MAIN ENGINE STATUS light on 
panel F7 


e Static engine Pc 
е MPS CMD (HYD, ELEC) message 
® MCC call 


Procedures for a stuck throttle are found on the 
MPS CMD/HYD/ELEC cue card. An SSME 
shutdown will be performed to protect for 
either SSME constraints for net positive suction 
pressure (NPSP) or to stay within the 3-g 
constraints. When this shutdown occurs varies 
for nominal ascent, TAL, and RTLS. However, 
it usually occurs about 30 seconds before 
MECO, to preserve the maximum amount of 
performance. 


Engines with command path failures must 
always be shut down manually using the MPS 
controller AC power switches. After shutdown, 
the shutdown pushbutton is depressed to set 
discretes that allow the software to recognize an 
engine failure. This is called ап AC/PB 
shutdown. 
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A single engine with a hydraulic or electric 
lockup will be shut down via the pushbutton 
only if three engines are running. 


For multiple stuck throttles, the crew will 
address them in the following priority: 


1. Command path failure 
2. Hydraulic lockup 
3. Electric lockup 

ET SEP Inhibit 


e MAIN ENGINE STATUS lights remain 
on panel F7 


® SM ALERT 
е SEP INH message 


This malfunction can be caused by excessive 
rates or a feedline disconnect failure. If rates 
are the problem, the crew damps them 
manually and allows the automatic separation 
sequence to occur. Feedline disconnect failures 
require the crew to execute a manual separation 
6 minutes after MECO. For performance 
problems or aborts, a separation may be 
performed sooner. 


ET SEP Switch 
е SM ALERT 
® ETSEP MAN message 
е ET SEP AUTO message (RTLS, TAL) 


The software automatically defaults to a crew- 
initiated ET SEP if this switch fails to MANUAL, 
except for RTLS and TAL aborts, where the 
default is AUTO. The switch is overridden 
using an item number on SPEC 51. 


MECO Confirm 
e No auto ET SEP 
e Glareshield DAP lights remain on 


e Panel C3 ORBITAL DAP lights remain 
off 


е Мо software mode transition 
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A failure of the software to confirm MECO 
prevents an auto ET SEP. The crew can set a 
МЕСО confirm flag in the software by 
simultaneously pushing all three engine 
shutdown pushbuttons, providing no other 
failures have occurred. The MECO confirm flag 
may also be set by manually moding the 
software via an OPS 104 PRO. 


Orbital Maneuvering System/ 
Reaction Control System 


Failures in the OMS/RCS are handled using 
procedures tailored for the current flight phase. 
For ascent, achieving a safe orbit while 
maintaining deorbit propellant margins is the 
primary concern. On orbit, maintaining at least 
two deorbit capabilities drive the procedures. 
During entry, vehicle control is paramount. 


Leaks 
e Helium pressure decrease 
® Propellant quantity decrease 
® МСС call 
е MASTER ALARM 
• OMS or RCS light on panel F7 


е Leak message 


Leaks must first be confirmed, using 
independent DPS display and meter 
indications, since sensor failures may cause 
false annunciation. Once confirmed, the crew 
attempts to isolate the leak by securing the 
affected system. Control requirements drive the 
procedure to be used. 


Helium tank leaks are identified by a continual 
helium pressure decrease after the system has 
been secured. For this case, propellant is 
burned from the affected system to achieve 
blowdown capability. Тһе point of “шах 
blowdown" (3976 OMS quantity, 22% RCS 
quantity) allows the optimum use of the system 
once all the helium is depleted. 


A helium leg leak can be identified by the 
helium pressure stabilizing after the system has 
been secured. In this case, the helium isolation 
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valves are manually operated to maintain pres- 
sure in the propellant tanks. 


If propellant tank pressure continues to 
decrease when the system is secured, a tank 
leak is indicated. (RCS tank leaks in MM 304 
are identified by propellant tank pressure 
diverging from good tank when the system is 
secured.) The system should be used as long as 
possible. Then a crossfeed is established to the 
other system prior to tank depletion. A burn 
may be performed to deplete the affected 
propellant tank, preventing leakage into the 
OMS/RCS pod where the corrosive propellants 
could damage other systems. 


RCS manifold leaks and leg leaks are indicated 
by a pressure drop in the individual manifold 
or manifold pairs after leak isolation. In 
general, the leaking manifold/leg will be left 
secured and operations will be continued using 
the good systems. 


Regulator Failed High 
e Pressure increase in OMS/RCS system 
е MASTER ALARM 
• OMS or RCS light on panel F7 
® OMS or RCS TK P message 


Helium isolation valves are closed per the 
appropriate procedure апа troubleshooting 
performed to isolate the bad regulator. 


OMS Engine/Propellant Failure 


e MASTER ALARM 


e Drop in OMS Pc and/or increase in 
OMS injector temperature 


• Reduced acceleration 

• Down arrow on ММУК display 
® OMS PC message 

e OMS light on panel F7 


Depending on flight phase, the appropriate 
OMS BURN MONITOR cue card is used. If the 
problem is real (16. not a sensor failure), the 
crew must use engine inlet pressures to 
determine whether the affect OMS propellant is 
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still available for use through the remaining 
OMS engine and/or RCS jets (i.e. ENG FAIL) or 
has been lost along with the engine (i.e., PRPLT 
FAIL). 


RCS Jet Failures 


е MASTER ALARM 

е RCS light on panel F7 

е RCS JET FAIL message 

e GNC SYS SUMM indications 

е SPEC 23 RCS display indications 


Jets can fail off, on, or leak. False annunciations 
may also occur. 


For a failed “on” jet, the RCS manifold must be 
quickly secured to prevent propellant depletion. 
If the failure was real, pressure will decrease in 
the affected manifold. 


A single failed "off" jet usually has no major 
effect, since the RCS jets have a great deal of 
redundancy. The remaining jets take over per 
the software jet select priority. If the failure is 
false, the jet may be reselected so that the DAP 
will attempt to fire it again. 


When a jet fail “leak” is annunciated, the crew 
and MCC examine available data to determine 
if the leak is real or an instrumentation prob- 
lem. For actual leaks, the appropriate manifold 
is secured only if the leak is large enough to 
cause a quantity divergence. 


Interconnect/Crossfeed 


Crossfeed valves and lines allow crossfeeds 
between the left and right OMS and the left and 
right RCS. The crossfeed valves and lines also 
allow the OMS and RCS to be interconnected. 
During OPS 1 and 3, placing the OMS/RCS 
switches in GPC allows the software to 
automatically reconfigure these valves and 
establish OMS/RCS interconnects for abort 
dumps and RCS crossfeed for large RCS leaks. 


For ascent abort dumps, the software will 
automatically configure the OMS/RCS valves 
to support interconnected flow, if required. The 
software will also automatically reconfigure the 
systems for DPS and electrical failures. With 
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multiple failures, however, the software may 
inadvertently leave the OMS and RCS in a bad 
configuration once the abort dump is complete. 
In such cases, the crew will need to manually 
reconfigure the OMS and RCS to prevent 
inadvertent propellant depletion or loss of 
control. 


When the systems are being operated in an 
interconnect or crossfeed mode, failure isolation 
becomes much more complex. Ш conditions 
permit, it is better to secure the OMS/RCS 
systems entirely prior to attempting trouble- 
shooting procedures. 


OMS Gimbal 
e MASTER ALARM 
е OMS TVC light on panel F7 
е OMS GMBL message 


• Downmode to secondary gimbal 
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Either a gimbal failure or its data path caused 
this annunciation. For either case, operation on 
the secondary gimbal is initiated. А second 
gimbal failure may require shutting down the 
OMS engine if control problems exist. Should 
the OMS engine be pointed near the orbiter's 
c.g, then the RCS and the remaining OMS 
engine may be able to maintain control. 


A gimbal failure that occurs prior to a burn will 
require the crew to use remaining gimbal 
system to park the affected engine through the 
c.g. Gimbal power is then removed via an item 
entry on the MNVR display. The procedure 
protects against the loss of the secondary 
gimbals which could render the OMS engine 
unusable. 
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6.9 MULTIPLE FAILURE 
SCENARIOS 


CONTENTS 


MPS He Leak with APC/ ALC 
Failure 

Set Splits During Ascent 

Stuck Throttle in the Bucket 

Second Hydraulic Failure and 1 
SSME Failed 

Two APUs/ Hydraulic Systems 

APU 1 and Multiple Prox Box 
Failures 


Two Егеоп/ Water Loops 
Total Loss of FES 


Total Loss of FES with BFS Failure... 

Two Fuel Cells 

Both OMS Engines 

OMS/RCS Leak with DPS/ EPS 
Failures 


This section briefly describes multiple failures 
that may be encountered during training. 
Although the potential for these failures in 
flight is very low, they allow flight crews and 
MCC personnel to exercise their knowledge of 
orbiter systems. For each case, crew actions are 
noted after the multiple failure is discussed. 


MPS He Leak with APC/ALC Failure 


A failure of APC 4 (5,6) or ALC 1 (2,3) causes 
the “A” helium isolation valve on the C(L,R) 
main engine, respectively, to close. Should the 
crew then close the “B” helium isolation valve 
on the affected engine (e.g., in working the 
helium leak isolation steps), the engine would 
be starved of helium and possibly experience a 
catastrophic shutdown. 


With an APC/ALC failure during powered 
flight, helium leak isolation must not be 
performed on the affected engine. A helpful 
cue that an APC/ALC has failed is the ullage 
pressure indication directly below the helium 
dP/dt readout on BFS GNC SYS SUMM 1. 
With an APC/ ALC down, power is taken away 
from the signal conditioners for the LH2/LO2 
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ullage pressure sensors. Consequently, LH2 
ullage pressure suddenly reads 12.0, and LO2 
ullage pressure reads 0.0 for the affected engine. 


Set Splits During Ascent 


GPC set splits during ascent (2V1V1 or 2V2) can 
cause control problems, inhibit ET SEP, or cause 
MPS command and data path problems. 
Because of this, should a set split occur during 
ascent, BFS engage may be required to prevent 
a loss of control, to regain throttling, or ensure a 
safe ET SEP. Flight Rules permit reconfiguring 
the PASS GPCs after the set split if certain very 
specific conditions are met. However, because 
of time criticality during powered ascent, there 
may not be enough time to reconfigure the set 
to ensure vehicle safety. In these cases, a BFS 
engage should be performed. 


Stuck Throttle in the Bucket 


For cases when an SSME throttle is stuck while 
still in the bucket (due to a MPS CMD, HYD, 
ELEC), it may be possible to continue into orbit, 
depending on throttle level and actual 
performance. (More than likely, a рге-МЕСО 
OMS dump would be required.) If uphill 
capability is lost, MCC may call for a TAL (or 
even an RTLS). This is a real-time call that can 
be made only by the MCC using the abort 
region determinator (ARD). A restring may 
also be performed in some cases if it will 
recover the stuck throttle. 


Second Hydraulic Failure and 1 SSME 
Failed 


Loss of two APUs or hydraulic systems during 
ascent causes a loss of TVC on one SSME. If 
another engine fails, the non-gimbaling engine 
may have to be shut down also to prevent loss 
of control. Simulations have demonstrated a 
high probability of control problems with two 
engines running and one non-gimbaling. 


Two APUs/Hydraulic Systems 


Loss of two hydraulic systems during powered 
flight will result in two SSMEs experiencing 
MPS hydraulic lockups, one of which has also 
lost ATVC capability. Steps will be taken to 
protect flight control against the next failure, 
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and a pre-MECO engine shutdown will be 
required to protect 3-g constraints. 


Loss of two hydraulic systems will also affect 
flight control for glided flight, since aerosurface 
rates are reduced. Abrupt maneuvers should 
be avoided to prevent control system 
saturation. 


APU 1 and Multiple Prox Box Failures 


Either hydraulic system 1 or one of the two 
landing gear proximity boxes is required to 
deploy the landing gear. APU 1 provides 
power for hydraulic system 1, which performs 
hydraulic gear deploy. Pyrotechnic backup is 
provided by either prox box. One of these three 
systems is required for a successful gear deploy. 


If two of these systems are failed, attempts will 
be made to recover at least one of them by 
repowering failed buses, resetting RPCs/circuit 
breakers, or restarting APU 1. Failure of both 
prox boxes results in all landing gear talkbacks 
remaining barberpoled. Gear deployment 
verification may not be possible via physical 
cues. 


NOTE 


Bailout is preferred over а gear-up 
landing attempt. 


Two Freon/Water Loops 


Loss of cooling capability requires ап 
emergency deorbit. Procedures are contained 
in the FDF CONTINGENCY DEORBIT PREP or 
the SYSTEMS AOA books for losses during 
ascent. It is extremely important to understand 
the related powerdown procedures for these 
cases and perform them expeditiously. 
Successful entry and landing depend on proper 
execution of the powerdowns. 


Total Loss of FES 


Complete loss of the FES during ascent requires 
an emergency payload bay door opening to 
obtain adequate cooling. Either the BFS or an 
SM GPC is used, depending on urgency and 
what other malfunctions are present. 
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If the FES has failed on orbit, the payload bay 
doors will be closed as late as safely possible 
prior to entry. The ammonia boiler will be 
activated as soon as possible for cooling during 
entry. Minimum acceleration of 0.05 g is 
required for ammonia boiler operation (around 
400 К). Due to entry heating and lack of cooling 
with a FES failure, orbiter temperatures will rise 
to high levels between payload bay door closing 
and ammonia boiler activation. 


Total Loss of FES with BFS Failure 


In order to accomplish emergency payload bay 
door opening with BFS failed, it will be 
necessary to either IPL a new BFS machine 
using the BFS GPC IPL procedure in the Ascent 
Pocket Checklist or transition a PASS GPC to 
SM OPS 2 using nominal post insertion 
procedures. MCC and the crew will work 
together to pick the best course of action 
depending on the time available, progress 
through post insertion when failures occur, and 
other system failures. 


Two Fuel Cells 


On orbit, all three main buses may be tied upon 
completion of the LOSS OF 2 FC POWER- 
DOWN. During ascent or entry, the cue card or 
Pocket Checklist powerdown is performed, but 
one main bus will remain unpowered to 
prevent overloading the remaining fuel cell. 


Both OMS Engines 


Assuming OMS propellant is still usable via 
OMS/RCS interconnect, the RCS jets are used to 
perform the remaining ascent and deorbit 
burns. A staged deorbit burn using 
aerobraking to provide some of the deorbit 
deceleration may be performed, so as to not 
overburn the jets. 


OMS/RCS Leak with DPS/EPS Failures 


Electrical failures affect the capability to operate 
the motor-driven OMS/RCS valves, and DPS 
failures take away crew insight and affect 
software commands to the valves. Ш time 
permits, the OMS/RCS sliderule is used to 
determine which valves are operational for 
various failures. — Some workarounds are 
available. These are coordinated through MCC. 
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For some control bus failures, it is possible to 
actuate OMS/RCS valves using GPC com- 
mands. The master crossfeed, automatic cross- 
feed, or a software read/write procedure is 
used to command the valve. 


MDM failures can cause the GPCs to lose RCS 
status information. This may result in good jets 
being declared failed or unavailable by the RM 
software. Using item entries on SPEC 23, it may 
be possible to override the software to the 
correct status and regain RCS jets or prevent 
firing a failed jet or jets on a failed manifold. 


Cryo Leak with Failed Manifold Valve 


A bus tie and fuel cell shutdown may be 
required to isolate the leak. The PCS systems 
may also be secured individually to assist in 
leak isolation. The manifold valve may be 


closed if the failed bus can be temporarily 
powered or an IFM performed. If the valve 
cannot be closed or the leak isolated, then two 
fuel cells will be lost when the cryo H2 or O2 is 
depleted. Emergency deorbit or ascent abort 
may be required, depending on leak rate. 


BFS Self Engage 


This scenario can occur as a result of multiple 
BFS GPC and Backup Flight Controller failures, 
or with only one failure and crew action. 
Certain failure modes of the Backup Flight 
Controller and the BFS GPC can put the BFS 
one failure away from self engage. Should this 
occur, the crew must be aware that moving the 
BFS OUTPUT switch out of BACKUP could 
result in a self engage. This is a condition 
where the BFS engages but the PASS does not 
shut down. 
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610 SWITCH AND PANEL 


CAUTIONS 


CONTENTS 


IDP/CRT Power Switch 


GPC/MDM 

PLB Mech Power /Enable 

HYD Press and APU Controller Power 
Switches 

OMS Kit 


Because the design of some orbiter controls 
is very similar, when they are placed in 
close proximity, inadvertent actuation can 
occur. Training, along with close attention 
during high workload tasks, will minimize 
these problems. This section discusses 
several potential areas where crewmembers 
should exercise caution to avoid pitfalls. By 
being aware that these situations exist, 
crewmembers сап execute time-critical 
procedures confidently. 


MPS Switches 


The six ENGINE POWER switches and the six 
He ISOLATION switches are located in adjacent 
rows on panel R2. The switches are very 
similar, except for a yellow band around the six 
power switches. Caution should be exercised 
during MPS helium leak isolation or SSME 
shutdown procedures. 


Fuel Cell Reactant Valves 


Because of panel design, which represents 
a schematic of the PRSD and FC systems, 
the FUEL CELL REAC valve switches are 
arranged in a 1-3-2 order (1 on top, 3 in 
the middle, 2 on the bottom) on panel КЛ. 
Closing the incorrect reactant valve results in 
the loss of a second fuel cell and possibly two 
main buses. 
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IDP/CRT Power Switch 


The IDP/CRT POWER switches on panel C2 are 
adjacent to the MAJOR FUNC switch. This makes 
it relatively easy to power off an IDP when 
intending to switch major functions. Ш this 
occurs, simply power the IDP back ON, inform 
MCC of the incorrect switch throw, and continue. 


GPC/MDM 


During dynamic ascent and entry, the GPC and 
MDM switches on panel O6 are very difficult to 
reach. They are also hard for the CDR to see 
when wearing a launch/entry suit helmet. 
When executing DPS malfunction procedures, it 
is important to ensure the correct switch is 
actuated. One technique is to have the MS2 
verify that the CDR has selected the correct 
switch prior to actuation. Powering off the 
wrong MDM or moding the incorrect GPC can 
leave you critical to a single failure. 


PLB Mech Power/Enable 


These switches are located adjacent to each other 
on panel R13L and perform entirely different 
functions. Because of their similar nomenclature 
and same appearance, they are easily confused. 
The PL BAY DOOR SYS ENABLE switches are 
used during PLBD opening/closing. The PL 
BAY MECH PWR SYS switches are used for 
other mechanical systems in the PLB (such as 
radiators, PRLAs, RMS, etc). A careful procedure 
crosscheck will avoid problems. 


HYD Press and APU Controller Power 
Switches 


The HYD MAIN PUMP and APU CNTLR PWR 
switches look similar and are in adjacent rows on 
panel R2. It is easy to confuse these two switches 
during the APU shutdown procedure or when 
taking a hydraulic system to LOW PRESS. 


OMS Kit 


OMS KIT switches are on the left side of panel 
O8. It is easy to confuse the OMS KIT switches 
with the LEFT OMS switches. The OMS KIT 
switches are inoperative. 
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6.11 


This section summarizes actual, in-flight 
failures that have occurred in the shuttle 
program. It includes major systems апа 
selected repeat failures important to the crew. 


SYSTEMS FAILURE SUMMARY 
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The purpose is to give crewmembers a feel for 
the type and severity of equipment failures and 
their potential impact on operations. Complete 
lists of anomalies and failures for both flight 
and ground operations are available from the 
Orbiter Project Office. 
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SYSTEM FAILURE CAUSE 


APU/HYD e APU lube oil temp high • WSB ice 
• Two APUs underspeed shutdown » Hydrazine leak and fire 
e APU shifted to high speed Failed control valve 
e Hydraulic leak on entry e Leak in pump hose 
e APU underspeed - FCS checkout e Valve contamination 
COMM e Loss of KU antenna gimbal and stow control e Loose screw and circuit burnout 


CRYO e O2 leak e PCS 02 restrictor installed backwards 


DPS • GPC 2 quit CPU timing 
e RS split Chip problem 
BFS failed pre-launch Failed string tracking 
e GPC 1 and 2 failed Contamination 
• GPC 5 failed Engage term errors 
• GPC 4 failed on orbit Failed to sync; changed on orbit 
е MDM OF3 failed pre-launch Component contamination 
е MDM port failure Power supply fail 
MDM failure pre-launch МО errors 
е МОМ card problems Card fail 


ECLSS е FES shutdown Ice, temp transducer, or thermal transient 
• FES failure to come out of standby Controller failure 
е Freon flow degrade Debris 
е Airlock equalization valve would not depress (for EVA) Debris 
E • Hum Sep signal conditioner B circuit breaker popped Wire bundles short 
e TAGS cable arcing Cable short 
e Fuel cell 1 failed H2 pump fail due to blockage 
e Fuel cells produced excessive hydrogen H2 entrainment in new filter screen 
e High drift rates IMU failed 
• Fuel cell coolant pump single phase AC short Wire damage 


PS 
GNC e IMU cage 
e IMU failed Power supply failed (9) 
e Spurious IMU accelerometer output Accelerometer component shift 
• 3deg/sec vehicle yaw rate during crew sleep Bad state vector uplink 
e Radar altimeter loss of lock/intermittent lock/fail Transmission system malfunction 
• TACAN no lock, up or biases Low receiver sensitivity 


Mechanical e Air data problems 


Systems • PLBD would not close Thermal warping 


e Brake damage on landing Inadequate brake capability 
e Thermal blanket and PLBD seal dislodged Unknown; venting suspected 


MPS e Pad abort after SSME start Engine valve slow to open 
e Launch scrub Various component failure, 
including H2 leakage 
e 14,000 Ib of LO2 drained from ET pre-launch. Operator error 
Launch held due to strange LO2 temp 
indications in engine 
• Orbiter ET/SRB structural breakup Right SRB lower field joint burnthrough 
• SSME failed (auto shutdown) АТО Failed sensor 
OMS/RCS • OMS cracks discovered post flight Launch stresses 
e Left OMS pod burnthrough APU detonation and fire 
• Loss of verniers F5L and F5R leak 
e RCS jet failed off OX valve failed/clogged Pc tube/ 
RCS jet failed leak main poppet stuck/He ingestion 
• RCS Reg leak Leaks 
Helium leaks 


Systems Failure Summary Chart 
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7. ТКА)ЕСТОКҮ МАМАСЕМЕХТ 
AND FLIGHT 


CHARACTERISTICS 


CONTENTS 


7.1 
7.2 
7.3 


7.4 


TERMINAL AREA ENERGY 
MANAGEMENT AND 
APPROACH, LANDING, AND 
ROLLOUT (OPS 305) 


This section presents space shuttle flight 
characteristics and trajectory management 
during powered flight, on orbit, reentry into the 
atmosphere, approach, landing, апа rollout. 
Some guidance and navigation information is 
included so the crewmember will be acquainted 
with the parameters that are important in 
influencing flight control. Much of the 
information was supplied by crewmembers who 
have flown the space shuttle. Additional 
information was derived from simulator runs in 
the Shuttle Mission Simulator, Shuttle Engineering 
Simulator, and Vertical Motion Simulator. 
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For each flight phase (ascent, orbit, entry), 
manual control techniques are presented, along 
with information on vehicle handling qualities, 
performance monitoring, and takeover criteria. 


For detailed information on these subjects, 
consult the appropriate Flight Procedures 
Handbooks, Flight Data Files, or Flight Rules. 


Each subsection discusses the primary controls 
and displays used during each flight phase. 
When used, external devices, such as runway 
lighting, ball-bar, and aimpoints, are integrated 
with the flight crew techniques in order to 
present a coordinated picture to the 
crewmember. 


Where the backup flight system (BFS) differs 
from the primary avionics system software 
(PASS), (also called primary flight system 
(PFS), BFS characteristics аге discussed 
separately. This generally applies to ascent and 
entry flight phases, because the BFS has limited 
capability on orbit. 


Each subsection concludes with rules of thumb. 
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7. TRAJECTORY MANAGEMENT 7-2 
AND FLIGHT CHARACTERISTICS 


7.1 ASCENT 


CONTENTS 


Powered Flight аии нинин нне 7.1-1 
Insertion OMS Burns ................................. 7.1-8 


Backup Flight System ................................ 7.1-9 
Sensory Сезан —— 71-10 
Ascent Rules of Thumb ............................. 7.1-12 


Powered Flight 


During powered flight, the crew monitors 
orbiter performance and system status using 
dedicated displays, DPS displays, and cue 
cards. This section describes the displays used, 
the monitoring task, takeover criteria, and 
manual control. 


DPS Displays 


Several types of DPS displays are used to 
monitor vehicle performance during powered 
flight. For a more detailed description of the 
displays presented here, refer to the Flight 
Procedures Handbook and DPS Dictionary. 


GNC TRAJ Displays 


In first stage, the PASS and BFS ASCENT TRAJ 1 
displays depict a nominal trajectory plot with 
altitude on the y-axis and relative velocity 
(Уве) on the X-axis. Altitude scale is from 0 to 
170,000 ft and velocity from 0 to 5,000 fps. Tick 
marks on the profile show attitude director 
indicator (ADI) pitch attitudes at appropriate 
reference points. Orbiter state (from МАУ) is 
displayed by a moving triangle with a 20 sec 
predictor circle. An airspeed scale is marked 
with speeds, and the current knots equivalent 
airspeed (KEAS) is shown by a triangle. A 
staging (SIG) tick mark denotes maximum q- 
bar for SRB SEP. 


The PASS and BFS ASCENT ТКА] 1 display, 
along with the ascent cue cards, are used to 
monitor first-stage trajectory. 


71-1 


USA007587 


Rev. A 
10217 ГА ASCENT TRAJ 1 1 888/88:08:83 
606/60 :00:63 
CONT ABORT 
ЗЕ0 BLUE 
2 ARM 2ЕО BLUE 
4 ABORT 
5 ENA YAW STEER 
6 SERC 


THROT 188 


66 
7 INH ОКР 1EO 


u 


DPS MENU 
Pix ОБЬ MEDS MEDS сл 
MSG К57||М56 ACHAUT 


PASS Ascent ТКА] 1 


ASCENT TRAJ 2 1 888/88:02:25 


600/08:82:25 


------------------ 


26 со 26 
CONT ABORT тео 6:00 
ЗЕО GREEN 
ARM 2Е0 BLUE 
ABORT 


18317 ^ 


ENA YAW STEER 


со НИНЕ 


o м aw 


SERC 


THROT 104 

PRPLT 73 
DROOP ALT 6 

TMECO 8:24 


7 INH ОКР 1Е0 


[1] 


DPS MENU 
Pix 2055 МЕО5 MEDS C1 
MSG RST||MS6 ACHAUT 


PASS Ascent TRAJ 2 


PASS and BFS ASCENT ТКА] 2 displays are 
automatically displayed at the transition to 
major mode (MM) 103. The profile represents a 
nominal second stage ascent with altitude vs 
inertial velocity (Vi) as the axes. Altitude scale 
ranges from 140,000 to 525,000 ft and velocity 
from 5,000 to 26,000 fps. Current altitude and 
velocity data from NAV is indicated by a moving 
triangle. Predicted states at 30- and 60-second 
intervals are represented with moving circles. The 
short line roughly parallel to the last part of the 
profile represents a TAL TRAJ for an engine 
failure at the earliest TAL opportunity. An 
expanded V; scale from 25,000 to 26,000 fps 
with a cutoff (CO) tick at the MECO velocity is 
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available at the top of the TRAJ displays. Current 
М is indicated by a moving triangle driven by 
NAV. The BFS ASCENT ТБА/ 2 shows total load 
factor (g) on a vertical scale, which ranges from 
2.0 to 3.5 g with current value indicated by a 
triangle. 


ASCENT TRAJ 2 5 888/88:82:41 


BFS 906/65:06:60 


co 26 


-288-4 


DPS MENU 


D MEDS сз 


5 
RST] [MSG АСКАОТ 


ME 
MSG 


BFS Ascent TRAJ 2 


The orbiter symbol and predictors should track 
the appropriate profile through MECO. Other 
monitoring items are: 


e V; used to monitor proper МЕСО 
velocity 


e g: used to monitor throttling. 


NOTE 


TRAJ DISPLAY titles change to include 
the abort mode when an ascent abort is 
executed. 


GNC SYS SUMM Displays 


GNC SYS SUMM displays are the principal 
means of monitoring flight-critical systems. 
They should be scanned frequently during 
ascent to verify system status and aid in 
determining causes for alarms. The BFS also 
supports a THERMAL display and two SM SYS 
SUMM displays. These are accessed by placing 
the BFS ТОР МА] FUNC switch to SM. These 
displays should also be scanned frequently to 
detect impending system problems and are also 
used to deal with orbiter systems problems 
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during ascent. DPS displays are presented in 
Appendix B. 


OVERRIDE Display 


The OVERRIDE display (SPEC 51) allows the 
crew to deselect/reselect certain line replaceable 
units (LRUs) to solve а redundancy 
management (RM) dilemma or to force RM to 
consider a previously deselected LRU. The 
OVERRIDE display also contains various soft- 
ware switches that may be used to override 
dedicated switch failures, controls for OMS and 
reaction control system (RCS) dumps, and 
several other additional functions. 


Dedicated Displays 


Dedicated displays are also used during ascent 
to monitor shuttle performance. 


The attitude director indicator (ADI) displays 
attitude, rates, and error information and is 
used in combination with the DPS displays and 
cue cards. ADI attitude depends upon the 
position of the ADI ATTITUDE switch on panel 
F6 or F8. Switch positions are: 


e REF: reference frame based on nominal 
launch azimuth at lift-off (can be | 
redefined) 


e LVLH: Earth-referenced pitch/roll (local 
vertical local horizontal) 


e INRTL: referenced to Mean of 1950 
(M50) inertial frame (see Section 2.13 for 
reference frame definitions) 


ADI rates are body rates driven by the rate gyro 
assemblies (RGAs). Scaling depends on the 
position of the ADI RATE switch. Switch 
positions during powered flight are: 


e HIGH: 10° per second 

e MED: 5° per second 

e LOW: 1° per second 
ADI errors are the difference between actual 
and commanded body attitude. Scaling is 


controlled by the ADI ERROR switch. Switch 
positions during powered flight are: 
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е ШСН: 109 
e MED: 5° 
e LOW: 1° 


The available scaling of ADI errors and rates is 
used to tailor vehicle displays for the sensitivity 
appropriate in each flight phase. If guidance is 
unconverged, the error needles will be stowed. 
An OFF flag is displayed for invalid or missing 
data. 


DAP: Auto 
Throt: Auto 


MM: 103 
ATT: LVLH 


х-тік| 32.0 | 


ЗОМЕМТ MENU 


Attitude Director Indicator 


The horizontal situation indicator (HSI) is used 
to monitor AUTO guidance апа provide 
information needed by the crew to Ну 
manually. HSIs provide a geometric view of 
orbiter location with respect to various NAV 
points. During powered flight, the HSI displays 
data relative to the target insertion orbit. 


North on the compass card is the desired 
insertion plane. Heading of the body +X axis 
with respect to desired insertion plane is read at 
the lubber line. The difference between current 
heading and north is vehicle yaw. A course 
pointer indicates heading of Vre, while the 
course deviation indicator shows estimated 
sideslip (the angle between body X-axis and 
Уке). The primary bearing pointer indicates 
heading to the selected runway for TAL and 
RTLS aborts only. It is not driven in first stage. 
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Heading of V; with respect to target insertion 
plane is indicated by the secondary bearing 


Notes 


A авы Velocity bearing pointer is 
displayed throughout a nominal ascent. 


Ж. лем». Velocity bearing pointer 
and Beta digital readout are displayed 
until 2+30 MET or 200K altitude, 
whichever comes first(B-limiting 
constraints released). 


: | " Course-arrow (magenta) is pinned to 0° 
on the compass card to mark the 
targeted inclination. 


e Х-Тік digital readout and CDI both 
display lateral offset from the targeted 
plane in n. mi. 


e  Alnc digital readout is the angular 
difference between the current and 
targeted inclinations. 


e The HSI compass card displays 0° 
through 360° counterclockwise while 
heads-down (as shown), then inverts 
clockwise after the roll to heads up 
(RTHU). 


pointer. 


The alpha/mach indicator (AMI) is driven by 
NAV during powered flight. ALPHA displays 
angle of attack, and ACCEL displays acceleration 
(computed thrust/weight) in second stage. The 
ALPHA tape is not driven in first stage. 


M/VEL displays magnitude of Укы. in first 
stage, then Vi in second stage, while equivalent 
airspeed (EAS) shows equivalent airspeed 
throughout powered flight. EAS is an indirect 
indication of q-bar. 


The altitude/vertical velocity indicator (AVVI) 
is driven by NAV during powered flight. ALT 
is displayed with respect to the selected 
runway. ALT RATE (H-dot) is the radial 
component of Vi. 
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Pushbutton indicators on the glare shield on 
panels F2 and F4 indicate status of PITCH, 
ROLL/YAW, and SPD BK/THROT. Lights 
within the pushbuttons correspond to control 
modes. The BODY FLAP pushbutton light also 
indicates the status of the main propulsion 
system (MPS) dump sequence post-MECO. The 
light comes on when the MPS dump is started 
and goes out when the dump is complete. All 
other pushbuttons extinguish at space shuttle 
main engine (SSME) zero thrust (MECO 
confirmed +3.75 sec). The BFC light illuminates 
when the BFS is engaged and flashes when the 
BFS is standalone. 


Powered Flight Monitoring 


Sequential SSME start is monitored on the 
chamber pressure (Pc) gauges on the OMS/MPS 
MEDS display. After solid rocket booster (SRB) 
ignition (about 7 seconds after SSME start) the 
orbiter should perform a vertical rise for about 8 
seconds, followed by a combination roll, pitch, 
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and yaw maneuver onto the launch azimuth. 
Roll attitude on the ADI should be 180° upon 
completion. Switch ADI ATT from REF to 
LVLH after the roll is complete to obtain proper 
pitch/roll attitude information. REF is used for 
lift-offs to avoid large ADI movements at the 
LVLH 90° pitch singularity. 


Throughout first stage, the crew monitors the 
parameters listed on the ASCENT ADI cue card 
(especially attitude) and also vehicle rates. 
Some deviation of the error needles during first 
stage can be expected due to load relief, but the 
error needles may not recenter precisely and 
veto differences in the load relief flight software 
and error needle display software logic. 
Guidance will turn the vehicle into unexpected 
winds to reduce aerodynamic loading during 
the load relief phase. The crew will be briefed 
on expected dynamic response prior to launch. 
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ASCENT ADI - NOMINAL 


TIME 0 
0:30 68 
0:50 61 
110 53 
1:30 39 
1:50 30 


H 


9K 
26K 
50K 
84K 
125K 


H 


656 
993 
1429 
1892 
2195 


(116 OCFR1 С 


р 
i 
0 


%РВРІТ REMAIN 
-STAGING- 
м 0 а Å 
6 19 217K 1721 
7 16 274 1270 
8 13 309 921 
9 11 331 638 
10 9 345 407 < 
12 6 356 66 < 
14 9 355 -143 = 
16 25 350 -226 5 
18 23 344 -263 + 
20 21 339 2140 
22 19 337 -102 2 
24 17 337 66 
25819 13 345 274 
ASCENT ADI 
Cue Card 


SSME throttle-down at 20 to 30 seconds and 
throttle-up at about 60 seconds is monitored on 
the Pc gauges. Throttle command (Т) is 
displayed digitally on the ASCENT ТКА). 


Second stage follows SRB SEP. DPS displays 
should change to MM 103, and AMI/AVVI 
tapes display inertial velocity. Monitor closed 
loop guidance convergence by noting that the 
time of main engine cutoff (TMECO) on the 
PASS and BFS ASCENT TRAJ displays is within 
a few seconds of the expected MECO time. 


The PASS and BFS ASCENT TRAJ 2 and the 
dedicated displays are used to monitor the 
trajectory during second stage. Continue to 
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compare displayed data with the ASCENT ADI 
cue card. 


The crew must be continuously aware of the 
orbiter’s abort mode status. Boundaries are 
monitored by Mission Control Center (MCC) 
based on tracking data and projected vehicle 
performance capability as computed by the 
abort region determinator (ARD) program. 
Boundaries are transmitted to the crew by the 
capsule communicator (CAPCOM), but the 
crew should use the NO COMM MODE 
BOUNDARY cue card to maintain onboard 
status if communications with MCC are lost. 
Boundaries listed on the CONTINGENCY 
ABORT cue cards should also be monitored. 
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NO COMM MODE BOUNDARIES 


NEG RETURN (104) 8200|2 ENG ZZA (104) 5800 


PRESS TO АТО (104) 9900 
ABORT TAL ZZA (4) 


SE OPS 3 (109) 12100 
SE ZZA (104) 14200] ЕО VI С] 
PRESS ТО МЕСО (104)14900] SE OPS 3 ZZA (109) 1А] 


МЕС ВЕМ (2 @ 67) 18400 
<< ЗЕ ZZA (104 al ] 
SE PRESS (104) 18600 (104) ( 


МЕС МБМ (2 @ 67) 20000|2 ЕМС МАМ (104) 5700 


LAST PRE МЕСО TAL 23000 ABORT TAL MRN (3) 


Е 


20100 |ЕОМ! 
20200| SE OPS 3 МЕМ (109) (130___] 


21900 
23400 | SE МАМ (104) Е кинин 


23700 
24100|2 ENG BEN (104) 5700 


24300 ABORT TAL BEN (2) 
24500 

24900] EO VI С 
25000| SE OPS 3 BEN (109) (12127771 


25100 
(2 


25200] SE BEN (104) 


NO COMM MODE BOUNDARY Cue Card 


About 60 seconds before MECO, 3 g throttling 
commences and is monitored on the Pc gauges 
and DPS displays. MECO should be observed 
at guidance predicted TMECO and near the 
design MECO velocity on the AMI. All three 
red MAIN ENGINE STATUS lights on panel F7 
will come on for a nominal MECO, and the 
ORBITAL DAP pushbutton lights on panel C3 
will illuminate after MECO confirmed is set in 
the GPC software. 


AUTO ET SEP should occur at MECO +20 
seconds and is indicated by the red MAIN 
ENGINE STATUS lights going out. A SEP INH 
message indicates vehicle rate in any axis 
exceeds 0.7° per second or failure of a feedline 
disconnect valve to close. For a rate exceedance, 
wait for rates to damp, and separation (SEP) 
will occur automatically. Feedline disconnect 
failure is handled using cue card and checklist 
procedures to perform a delayed ET sep. 


After external tank separation (ET SEP), an 
automatic -Z translation occurs to obtain 
-4 ft/sec DV and move the orbiter away from 
the external tank. Upon completion, the crew 
should observe software transition to MM 104 
by the appearance of the MNVR displays on the 
DPS displays. 


Takeover Criteria 


During powered flight, the crew should be 
prepared to take whatever action is necessary in 
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off-nominal situations to preserve safety and 
mission success. The Flight Rules define poten- 
tial takeover criteria. These rules are built into 
the Flight Data File cue cards and checklists. 


The most serious situations involve control 
problems. In many cases, these are time-critical 
and an FCS downmode (control stick steering 
(CSS) ог BFS engage) must be rapidly 
performed. Downmode is an onboard decision 
that may be made for: 


e Impending loss of control 


e Failure of an expected maneuver to 
occur 


e Unexplained attitude/rate excursions or 
undamped oscillatory motions 


If the roll maneuver is not initiated as 
scheduled, auto guidance is considered no-go, 
and a BFS engage should be performed. 


Throughout first-stage flight, rate excursions 
are a parameter requiring crew action. Prior to 
90 seconds, if pitch or yaw rates exceed 5° per 
second, the crew should engage BFS. After 90 
seconds, the crew should select CSS, followed, 
if necessary, by BFS engage. 


CAUTION 


With manual throttle control selected, an 
automatic guided MECO will not occur. To 
obtain the correct MECO velocity, the main 


engines must be shut down manually. In 


low performance cases, а low-level 
shutdown may occur prior to the planned 
MECO velocity. 


After staging, if TMECO has not converged 
within 10 seconds, MCC should be consulted. 
In a NO COMM situation, CSS and manual 
throttle should be selected. 


To avoid violation of range safety limits, CSS 
takeover may be required. MCC will provide 
yaw steering commands to allow the crew to fly 
away from limit lines. Trajectory deviations of 
such magnitude to require takeover are 
extremely unlikely. Potential causes are: 
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е Faulty onboard МАУ 
e Erroneous guidance 
e Launch day winds 


® SRB dispersions 


Range safety agreements for first-stage 
deviations allow for limit exceedance as long as 
control is maintained. 


As the orbiter approaches 3-g acceleration, 
throttling commands and SSME throttle-down 
should be observed. If this does not occur, 
manual throttling must be performed using the 
pilot’s speed brake/thrust controller (SBTC) to 
ensure vehicle loads do not exceed design limit 
constraints. 


Any time the AUTO guidance is unacceptable 
for vehicle attitude control, it should not be 
allowed to control the main engines. Manual 
throttle should be selected whenever CSS 
takeover is initiated. Automatic guided MECO 
is inhibited with manual throttles selected. 


If MCC predicted TMECO is 2 seconds different 
than onboard predicted TMECO, a manual 
SSME shutdown will be initiated on the 
ground-computed value. 


The MCC abort region determinator (ARD) 
program is the prime tool for determining abort 
capabilities. The onboard NO COMM MODE 
BOUNDARIES cue card lists inertial velocity 
values that define flight design mode 
boundaries computed prior to flight using 
predicted ascent performance апа including 
ground rule flight performance reserves. The 
ARD is a real-time computational system 
designed to handle: 


e One ог more SSME failures at any time 


e Performance dispersions visible in the 
vehicle state 


e Performance dispersions not visible in 
the vehicle state 


e SSME mixture ratio changes 
Multiple or single-engine abort capabilities are 


determined throughout ascent for any combi- 
nation of these failures using ground radar 
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tracking or telemetry of current vehicle state. A 
discussion of performance boundaries 15 
presented in Section 6. 


Should the translational hand controller (THC) 
be moved out of detent post-MECO and prior to 
the completion of the -Z ET SEP maneuver, the 
maneuver will be inhibited (terminated if in 
progress) with no moding to MM 104. If for 
any reason the -Z maneuver is not completed 
either automatically or manually, the crew can 
manually mode to MM 104 by keying in OPS 
104 PRO. 


Manual Control 


Select manual control during powered flight by 
depressing the PITCH or the ROLL/YAW CSS 
pushbutton indicator on the commander (CDR) 
or pilot (PLT) eyebrow panel (F2 ог F4). 
Selecting any CSS pushbutton indicator gives 
CSS in all axes to both the CDR and the PLT. To 
reselect auto control, depress the PITCH or the 
ROLI/YAW AUTO pushbutton indicator on the 
CDR or PLT eyebrow panel (F2 or РА). 


If CSS is selected, manual throttles will also be 
selected on panel C3. The PLT can select manual 
throttle by depressing the red button on the C3 
SBTC and moving the lever to match the current 
commanded throttle setting within 4 percent. As 
the throttle level is matched, the AUTO SPD 
BK/THROT lights extinguishes on the eyebrow 
panels, and the MAN SPD BK/THROT light on 
the PLT side eyebrow panel illuminates. SSME 
throttling is then controlled by the PLT’s SBTC. 
The CDR manual throttle light does not 
illuminate because manual throttling cannot be 
accomplished from that side. Pushing the SPD 
BK/THROT pushbutton on the C2 or C4 eyebrow 
panel returns throttle control to the digital auto 
pilot (DAP). 


The control system in powered flight is rate 
control, attitude hold, with a maximum rate of 
about 12° per second in pitch and roll, and 
about 6° per second in yaw. If both КНС are 
out of detent, the rates are summed. 


To fly a nominal ascent to MECO in CSS, the 
trajectory displays and the ASCENT ADI cue 
card are the prime апа secondary tools, 
respectively. Displayed data are only as good as 
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the NAV state, so the crew must confirm NAV 
state with MCC at takeover. 


The ADI is primary for roll and is used to 
maintain roll at 180° before the roll to heads up 
(RTHU) cue and then 0° after the RTHU cue. The 
ADI is secondary for pitch. 


The 4) (Earth-Relative Velocity) bearing 
pointer is primary for yaw in first stage. Placing 
it on the lubber line (nose) creates the best 
conditions for attach point loading and SRB SEP. 


The Ду (Inertial Velocity) bearing pointer is 
primary for yaw after SRB accelerations have 
dissipated in second stage (MET 2:30). Placing 
it on the lubber line (nose) creates the most 
efficient yaw profile because it points to the most 
in-plane heading. 


The ASCENT TRAJ display is primary for pitch. 
Steer to keep the current state bug (triangle) and 
the two predictor bugs (circles) on the TRAJ line 
while making small (less than 5°) attitude 
changes. Observe the results prior to making 
each subsequent correction. 


If BFS guidance is good, BFS roll pitch and yaw 
digital information can also be used to fly the 
ascent profile. 


Because H-dot at MECO is extremely critical, 
concentrate on controlling H-dot rather than 
altitude within 90 seconds of MECO. Attempt 
to achieve the nominal MECO H-dot shown on 
the ASCENT ADI cue card. This will result in a 
nominal gamma or flight path angle at MECO. 
Errors of +100 fps are usually acceptable, while 
a positive H-dot (and gamma) is always 
required. 


Use the ASCENT ADI cue card to confirm 
MECO velocity and H-dot. 


CRM: As the CDR is flying CSS; the PLT 
manages manual throttle control. М52 
coordinates the CDR and PLT actions. Manual 
throttle requires а manual МЕСО. Trajectory 
monitoring is everyone's first duty. Roll to the 
ADI, pitch to the TRAJ, and yaw to the HSI. 
CSS requires manual throttle. Perform manual 
shutdown by depressing all three shutdown 
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pushbuttons on panel C3 when the cutoff bug 
meets the cutoff mark. Time of manual MECO 
can be anticipated as the cutoff bug approaches 
the cutoff mark. Push the SSME pb’s ahead of 
(lead) the MECO C/O cue by about 150 fps 
(about a bug width) to allow for SSME tail off. 
This procedure will result in the best possible У, 


at MECO. 


Insertion OMS Burns 


Monitoring and Targeting 


To monitor insertion OMS burns (OMS 1 
and/or OMS 2), the MNVR EXEC display and 
BFS GNC SYS SUMM 2 are used in addition to 
the ADI. These displays are available in both 
PASS and BFS in similar formats. The MNVR 
EXEC display provides digital data to target 
and monitor orbital maneuvering system (OMS) 
burns. MNVR EXEC is an interactive display 
requiring keyboard inputs from the crew, as 
well as monitoring prior to and during burns. 
Current HA and HP are used in conjunction 
with the OMS 1/2 TGTING cue card to 
determine which OMS targets should be used. 
Each mission has a flight-specific card, which the 
crew must understand thoroughly. The MNVR 
display is described in detail in Section 2.18. 


After the crew loads the appropriate targets, the 
GPC software will compute a burn solution. 
The target set and burn solution can be checked 
by comparing data on the DPS display with the 
expected solution listed in the OMS targeting 
section of the ascent check list or OMS 
maneuver pads. 


1941! rj EXXXX ММУЯ ҮҮҮҮҮ XX X 0ро/гнн мм $5 
OMS пати iX 075 ппо/нк:жм:2 
L 2х8 BURN АТТ ххх 
24 А Xxxx avTor XXXX.X 
25 Р Ххх Teo 
$ ТУ ROLL XXX 26 у XXX 


MNVR 27X XXXXX VOO X эХХХХ. KE 


в RY рх. 
9 WT XXXXXX Өм НА НР 
16 119 L а тат ххх ХХ 
271275513517 Р £X.X8 2%. KS CUR ххх ХХХ 
өт ба 


sec 30x 31K 
OFF зїхо зэх 
18 PRPLT ЮШҮХХҮҮХ ARM зах 
о? GMEL cK зах 
+9 лух хїї. $ 
Idxxx.x SURF ОЛІУЕ 
і Ау: (ххх. ом Sex 
XXXX 22/71МЕН 23 OFF «ох 


= ЕЕ 


MNVR Display 


XXXXXXX 
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For a quick check, scan РУТОТ, ТСО, apogee 
altitude (HA) and perigee altitude (HP), burn 
attitude, and time of ignition (TIG) to make sure 
they are reasonable. Before executing a burn, 
automatic maneuvers to the inertial burn 
attitude may be performed using ITEM 27. 
Prior to executing the burn, crosscheck the 
attitude with the ADI and compare PFS and 
BFS solutions. 


NOTE 


Burn attitudes on the MNVR display are 
inertial, and the ADI MODE switch must 
be in INRTL for a proper crosscheck of 
orbiter burn attitude. 


The ADI is used for OMS burns in a similar 
fashion to its use during powered flight. BFS 
GNC SYS SUMM 2 is used to monitor the OMS 
system during insertion OMS burns. 


Once the targets are loaded, and a solution is 
available, the crew follows ASCENT 
CHECKLIST/OMS Burn cue card procedures to 
prepare for and execute the burn. When in the 
correct burn attitude, error needles should be 
centered, and the ADI inertial attitude and 
commanded attitude on the MNVR display 
should match. 


CAUTION 


If OMS 1 is required, maneuvering to burn 
attitude should be delayed if the DAP has 


failed to maintain the orbiter within 10° of 
the ET SEP attitude during the -Z 
translation. This will avoid recontact with 
the ET. 


Provided perigee is high enough to remain in 
orbit for a few revolutions, cutoff conditions of 
an ascent OMS burn are relatively uncon- 
strained compared to a deorbit burn. Achieving 
the planned orbit is a mission success issue. 
Reaching an orbit above minimum HP is a 
safety issue. For failures during insertion OMS 
burns, the crew will downmode from 2 OMS to 
1 OMS to + X RCS to forward RCS as necessary 
to reach at least minimum HP. Downmode 
procedures are listed on the INSERTION OMS 
BURN cue cards. 
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Manual Control 


Takeover criteria and manual flight characteris- 
tics during insertion OMS burns are similar to 
those encountered during deorbit burns. Refer to 
Section 7.3 for a more detailed discussion of OMS 
burn takeover criteria and flight characteristics. 


Insertion OMS burns for ascent aborts are 
discussed in Section 6.2. Some special 
situations encountered during insertion OMS 
burns are discussed here. 


Backup Flight System 


The BFS is unique software contained in a 
single GPC that supports nominal ascent and 
most shuttle aborts. The ВЕб can be engaged at 
any time after lift-off. Once engaged, it is 
irreversible until the orbiter is in orbit or back 
on the ground. 


BFS state vector degrades very rapidly during 
powered flight if the BFS is standalone, since it 
is propagated using the last known 
accelerations from the inertial measurement 
units (IMUs). Therefore, if the PASS were to 
fail, BFS engage must be performed within 10 
seconds to ensure the vehicle will remain under 
control. 


BFS engage criteria are listed in the Flight Rules 
and summarized on the DPS cue cards. They 
include: 


e Loss of redundant set 


® Loss of PASS capability to control the 
vehicle due to general purpose com- 
puter 
(GPC)/ multiplexer / demultiplexer 
(MDM)/ LRU failures 


e Loss of control due to divergent 
trajectory 
e КОП maneuver not initiated as 
scheduled 


There are a number of functional differences 
between the PASS and the BFS: 


• No manual control during powered 
flight. 


е No manual throttling. 
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e ВЕБ does 
aborts. 


not support contingency 


• Nosingle-engine roll control. 


e BFS runs pre-engage in parallel with 
PASS although not in control of the 
orbiter. 


е BFS has only one memory load. Unique 
ascent and entry requirements are 
merged into one common set of 
guidance requirements. 


е When BFS is engaged, it takes command 
of all flight-critical buses. 


• When BFS is engaged, two IDPs are 
driven unless additional IDPs are 
assigned with keyboard inputs. 


e The BFS can 
simultaneously 
limited to three. 


drive all four IDPs 
while the PASS 15 


• BFS performs limited SM functions 


• Post ЕТ SEP, only AUTO -Z translation 
is available. In the TRANS DAP, 
attitude maneuvers are manual only. 


e OMS burn attitude must be controlled 
manually. 


Sensory Cues 


Prelaunch, SSME gimbal checks can be felt 
through the shuttle structure. 


First stage is characterized by a rapid g buildup 
to slightly over 2 g, accompanied by a great 
deal of noise and vibration. Instruments and 
DPS displays can be monitored, but precise 
tasks are difficult. 


SRB SEP results in a large amount of flame 
across the windows from the SRB separation 
motors. When the flame disappears, forward 
windows appear to be coated with residue, 
making them nearly opaque at certain Sun 
angles. 


At SRB SEP, g-load undergoes а nearly 


while PASS GNC does not. instantaneous reduction from 2.3 g to 1.0 g, 
coupled with a significant reduction in noise 
and vibration. Since the orbiter is above most 
of the atmosphere, many crewmembers have 
remarked that it seems to stop accelerating. 
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Vehicle Acceleration During Ascent 
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During second stage, g-load builds very 
gradually until 3 g's are reached and the SSMEs 
throttle to maintain 3 g. 


A good fit of the pressure suit and harness is 
very important to avoid discomfort during 
ascent, particularly at high g loads. Centrifuge 
runs with actual flight equipment should be 
performed to ensure proper adjustment. 


Some crewmembers report that the eye position 
in an actual orbiter differs from that 
encountered in the SMS. Checking seat position 
in an actual orbiter prior to flight is 
recommended for first time flight deck 
crewmembers. 


MECO results in g-load decreasing rapidly to 
zero. Indication of MECO is limited to 
observing the red SSME status lights, Pc meter 
readings dropping to 0, and g-reduction. 
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Some crews have reported an audible thump at 
ET SEP which could be caused by the explosive 
severing of the forward attach fitting. Other 
crews noted that ET SEP had occurred by 
extinguishment of the SSME status lights. 


When the forward RCS jets fire to perform the 
-Z translation, their ignition is accompanied by 
a loud boom (just like “cannons” according to 
some crewmembers). АН jets produce а 
noticeable structural vibration, but no sound. 
The OMS engines do not produce sounds, but 
the thrust can be noted by unrestrained objects 
translating aft in the cabin. 


Night launches are a special case. The SRB and 
SSME plumes appear to reflect off the air 
molecules and produce a “pulsing” light that is 
most pronounced through the overhead 
windows, but can be seen through the front 
windows also. 
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Ascent Rules of Thumb • 
• AtL/O, check Auto FCS. 


• Monitor roll program on the ADI and BFS 
ASCENT ТКАЈ display. 


• Before L/O +90 seconds, BFS engage is the 
crew's only option for loss of guidance 
and/or control. After 90 seconds, the crew 
can try CSS. 


* Monitor the trajectory on the ASCENT ADI 
cue card and the PASS and BFS TRAJ 
displays. Тһе shuttle bug and predictors 
should follow the nominal trajectory line. 
Also monitor the HSI for the inertial velocity 
to be in the desired orbit insertion plane. 


Monitor guidance convergence by observing 
PASS and BFS ТМЕСОв converging to 
expected time. 


If the crew takes CSS, they should take 
manual throttles. If the crew takes manual 
throttles, manual shutdown is required unless 
a low level shutdown occurs due to low 
performance. Тһе cue for MECO is the 
MECO cutoff bug on the PASS or BFS 
ASCENT TRAJ 2 display, or planned MECO V, 


minus 150 fps. 


Use OMS 1 TGTING cue card for system 
problems and OMS 1/2 TGTING cue card for 
performance problems to determine proper 
OMS 1 and 2 targets. 


CSS means manual throttle and manual 
throttle means manual MECO. 
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Orbit Rules of Thumb 


Attitude Control 


Orbiter attitude is primarily controlled auto- 
matically using either inertial attitude hold or 
track mode. The universal pointing (UNIV 
РТС) display, combined with the digital 
autopilot (DAP) display and control panel C3 
are used for automatic attitude control. For 
manual attitude control, the RHC is also used. 


Orbit flight control software includes the RCS 
DAP, OMS TVC DAD, an attitude processor to 
calculate vehicle attitude, and logic to govern 
which DAP is selected. Attitudes calculated by 
the attitude processor are displayed on the ADI 
and UNIV PTG. Vehicle attitude is used by the 
DAP to determine attitude and rate errors. 


As part of mission planning, an attitude 
timeline (ATL) is generated. While the Flight 
Plan is being developed, the ATL is also 
developed using information about payloads, 
experiments, and other constraints. An ATL is 
produced for both the Basic and Final versions 
of the Flight Plan. When complete, the ATL is 
incorporated into the Flight Plan, although it is 
not usually flown. Missions with large 
numbers of time-critical maneuvers may carry 
the ATL onboard and use it to perform 
maneuvers. 


Common Attitudes 


While each shuttle mission is unique, some 
attitudes are used frequently and are described 
briefly in this section. 


Тор/ВоНот Sun 


These are inertial attitudes that point either the 
+7. or -Z body axis at the Sun. They are normally 
used for thermal control of payloads. Obviously, 
a rotation angle about the pointing axis must be 
defined to constrain the attitude. This is usually 
flight-specific and is driven by look angles, 
communications coverage, or other constraints. 
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Tail Sun 


Another inertial attitude, but with the -X axis 
pointed toward the Sun. This is one of the 
coldest attitudes. 


Nose Sun 


Opposite to tail Sun. A semi-cold attitude used 
to cool the aft section of the orbiter or to warm 
the nose area, particularly the nose wheelwell. 


Deorbit Prep Tail Sun 


A special case of the tail Sun attitude designed 
to “cold soak” the radiators prior to entry. This 
is a track attitude using body vector of pitch = 
184°, yaw = 0°, and ОМСКОМ either 90? ог 270°. 


Tail Sun Rotation 


The coldest attitude for the payload bay. This is 
an inertial attitude that keeps the -X axis 
pointed at the Sun while phasing rotation to 
keep the payload bay pointed away from the 
Earth. It is used for thermal bending tests or to 
meet specific payload requirements. 


Passive Thermal Control (PTC) 


This is another inertial attitude rotation about 
the + or -X axis, but it maintains the Sun in the 
Y-Z plane. The result is even warming of the 
orbiter. PTC is sometimes called the “barbecue” 
mode. It is used to meet various payload 
thermal constraints. 


Gravity Gradient 


A stable attitude controlled Бу balancing 
differential gravitational and aerodynamic forces. 
The RCS is not used. Combined forces are very 
small, and only a few stable attitudes exist. 
These are difficult to establish and vary 
according to altitude, inclination, time of year, 
and many other variables. Gravity gradient is 
used to conserve propellant or to inhibit RCS 
firings during certain payload tests апа 
experiments. 


Local Vertical Local Horizontal (LVLH) 


This attitude maintains a constant orbiter 
orientation to the earth. Typically, the -Z axis is 
pointed at the center of the earth with the 
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-X axis pointed in the direction of the velocity 
vector. This attitude (payload bay to the earth, 
tail into the wind) provides excellent extended 
earth viewing for the crew and PLB 
experiments. 


Displays 


Attitude data for the attitude processor are 
provided by the inertial measurement units 
(IMUs). Rate data are derived from the IMUs 
by dividing attitude delta by the time interval 
between attitude measurements. 


ADIs provide an analog attitude display 
relative to three selectable reference frames. 
These are selectable via the ADI ATTITUDE 
switch. Inertial (INRTL) and reference (REF) 
positions represent inertial reference frames. 
Local  уег са Лоса] horizontal (LVLH) 
represents the orbiter in a fixed position relative 
to a rotating reference frame. 


In addition to the forward ADIs, which always 
operate in the +X sense, the aft ADI may 
operate in either a -X or -Z sense. Selection is 
made using the ADI SENSE switch. This allows 
proper orientation, depending on whether the 
crewmember is viewing through the payload 
bay (-X) windows (W 9/10) or the overhead (-Z) 
windows (W 7/8). 


The ADIs also display attitude errors that are 
calculated from the difference between current 
attitude and required attitude. The error 
needles are mechanized to indicate a “fly-to” 
sense (i.e. the direction in which to maneuver to 
null the errors). Rate needles are also fly-to (i.e. 
the direction in which to maneuver to null the 
sensed rates). 


Control 


Attitude control on-orbit is provided by the RCS. 
The RCS is designed to control the orbiter 
independently in each of three axes. Minimum 
on/off cycle time for the jets is 80 milliseconds. 
Vernier jets (25 lb thrust) are normally used on 
orbit for attitude control since the primary jets 
(870 Ib thrust) use more propellant for fine 
attitude control. Primary jets are used for 
translation and higher rate attitude maneuvers. 
ALT PRCS DAP uses the primary jets but limits 
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the number, duration, and spacing of jet firings to 
achieve attitude control and RMS loading similar 
to vernier jets. 


OI-23 added notch filter capability. Simply 
stated, notch filtering allows the crew to select 
different frequencies to attenuate. This new 
capability was driven by the previous need for 
extensive preflight stability analysis in regard to 
the acceptable RMS/ payload position envelope. 
Without notch filtering, the DAP may tend to 
excite rather than damp attitude oscillations 
caused by an unstable RMS/ payload position. 


For OMS burns, the OMS TVC DAP controls 
OMS engine gimballing, allowing OMS engine 
thrust vectors to be independently pointed 
several degrees in any direction relative to the 
orbiter c.g. This allows complete attitude control 
with the OMS engines alone during normal two- 
engine burns. For single-engine OMS burns, the 
RCS is used for roll control. The OMS TVC DAP 
also contains an RCS “wraparound” capability. 
If the attitude error exceeds 10° in pitch or yaw, 
or 5° in roll during an OMS burn, RCS jets are 
fired to correct the attitude. 


DAP Configuration 


The DAP uses current attitude to determine 
attitude and rate errors. 


Rotation rates and deadbands are functions of DAP 
configuration. Values may be changed on orbit 
using SPEC 20 DAP CONFIG. For convenience, 
each planned DAP configuration is assigned a 
number. The crew uses these numbers, which are 
called out in flight data file procedures, to select the 
proper DAP mode for maneuvers. Typically, 
DAP A has lower rates and larger deadbands than 
DAP B, making it more propellant conservative. 
However, the various DAPs are configured in any 
number of ways to meet mission objectives. 


Attitude Control 


Rotation and pointing maneuvers are required 
to achieve correct attitudes for deployments, on- 
orbit burns, star tracker operations, thermal 
control, flyarounds during proximity opera- 
tions, and pointing. 


The RCS controls rotation independently in three 
axes. Jets are appropriately located and oriented 
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to provide this control. Two independent sets of 
jets, primary (PRI) and vernier (VERN) are 
capable of attitude control. Most on-orbit rotation 
maneuvers are performed with the VERN jets. 
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UNIV PTG Display 


The UNIV PTG display is used to control 
automatic attitude maneuvers input by the 
crew. By entering data on the UNIV PTG 
display, the crew can command automatic 
maneuvers to point a specific body axis at a 
specified target, maneuver to a predetermined 
attitude, rotate about a specified body axis, or 
maintain attitude hold. The UNIV PTG display 
also shows attitude information, errors, and 
completion time for current maneuvers. Types 
of automatic attitude maneuvers are presented 
in the following summaries. 


To perform an automatic maneuver, the crew 
first enters the required data on the UNIV PTG 
display for the desired maneuver. To start the 
maneuver at a set time, that time is also entered 
on the UNIV PTG display. After checking the 
data, the crew enters an Item 18, 19, or 20, as 
appropriate, to start the maneuver. With AUTO 
DAP selected, an auto maneuver will begin at 
the set time or as soon as Item 18, 19, or 20 is 
entered if the maneuver start time is in the past. 
Item 21 is used to cancel a maneuver. 


Maneuver 


The maneuver (MNVR) option is used to 
maneuver the orbiter from current attitude to a 
new inertial attitude specified on UNIV PTG. 
AUTO maneuvers are three-axis at the rate 
specified on SPEC 20. Maximum acceptable 
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error in any axis is the SPEC 20 attitude 
deadband (ATT DB). Total error, displayed on 
UNIV РТС,, is the difference between required 
and current attitude. Allowable rate error in 
any axis is specified by the rate deadband 
(RATE DB) on SPEC 20. When the flight control 
software determines the orbiter is at the 
required attitude, attitude hold is initiated. 


NOTE 


Manually maneuvering away from a 
commanded attitude is possible. 
However, the DAP will return the orbiter 
to the commanded attitude when AUTO 
is reselected. 


Track 


The track (TRK) option is by far the most 
complex in universal pointing software. There 
are six subcases: orbital object tracking, center 
of Earth, Earth-relative target, center of Sun, 
celestial target (e.g, planet, Moon), and 
navigation star target. Each subcase is selected 
by a target ID (TGT ID) on UNIV PTG. The 
TGT ID is the line of sight or target vector from 
the orbiter c.g. to one of the defined targets. 


The track option is used in conjunction with a 
body pointing vector, which is centered at the 
orbiter c.g. and is defined by a pitch and yaw 
combination. These angles are referenced to the 
orbiter *X axis. 


Track software allows the crew to point a 
specified body vector at one of the defined 
targets. Attitude is not completely constrained 
until body orientation about the body pointing 
vector has been specified. Rotation about the 
body pointing vector is called OMICRON. By 
selecting a pitch, yaw, and OMICRON, a body 
pointing vector and the orbiter's orientation 
with respect to that vector are specified. 


When a TRK option is initiated, TRK software 
performs a three-axis maneuver at the rate 
specified by the current DAP, then begins active 
track of the target. TRK subcases perform the 
following functions: 
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Orbital object tracking (TGT ID = 1) 


State vectors of the orbiter and another orbiting 
target are used to determine a relative target 
vector. The target state vector is maintained by 
the REL NAV software. This mode is used 
post-deploy to track a payload. It is also used 
extensively during rendezvous operations. 


NOTE 


It is important to have REL NAV (RNDZ 
NAV) enabled (SPEC 33, ITEM 1) prior to 
tracking another orbiting body. It is also 
important to disable a TGT ID = 1 prior to 
an OPS transition. Although UNIV PTG 
remains active in OPS 8, REL NAV does 
not. Excessive fuel usage could occur due 
to universal pointing chasing a stale state 
vector. 


Center of Earth (TGT ID = 2) 


Selected body vector is pointed at the Earth, 
with orientation specified by OMICRON, and 
maintained. This is, in effect, an LVLH attitude 
hold, requiring the orbiter to establish a small 
rotation rate that matches orbital rate. Center of 
Earth tracking is frequently used on orbit for 
normal operations that do not require specific 
attitudes. 


Earth-relative target (ТСТ ID = 3) 


Latitude, longitude, and altitude of an Earth 
target are entered on UNIV PTG. This 
determines target line of sight from the orbiter. 
TRK maintains this attitude. Latitude and 
longitude are entered in degrees. Altitude is 
entered in nautical miles. Typically, primary jets 
will be required to maintain this track as the 
orbiter flies over the target. 


Center of Sun (TGT ID = 4) 


Present values of right ascension (RA) and 
declination (DEC) are used to determine line of 
sight to the center of the Sun. TRK then 
maintains the proper attitude. RA and DEC on 
the UNIV PTG display are updated with each 
new recall of TGT ID=4 as the Sun КА and DEC 
change. This mode is used primarily for 
thermal control. 
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Celestial target (ТСТ ID = 5) 


RA and DEC of a desired celestial object are 
entered. TRK will then point the defined body 
vector at this target and commence tracking it. 
An astronomical target can be tracked in this 
mode to point specific instruments. It may also 
be used during payload deployment to provide 
illumination or shading. 


Navigation star target (ТСТ ID = 11-110) 


TRK software contains the RA and DEC of 100 
navigation stars that are defined by a number 
(11-110). Selecting a particular star and 
defining a body vector allows TRK to point the 
body vector at the star and track it. Obviously, 
this mode can be used for star sightings. It may 
also be used to point instruments. 


Rotation 


The rotation (ROT) option takes the body vector 
defined by pitch and yaw and initiates a rate 
(specified on DAP CONFIG, SPEC 20) about it, 
while holding that axis in an inertial attitude. 


NOTE 


Transitioning to OPS 8 with an active 
rotation continues the rotation. Ensure 
correct DISC RATE is selected prior to 
transition, since neither UNIV PTG nor 
DAP CONFIG (SPEC 20) is available. 


Cancel 


Executing the cancel (CNCL) item on UNIV 
PTG snapshots and maintains current inertial 
attitude. All other current and future options 
(MNVR, TRK, ROT) are terminated. CNCL is 
selected automatically when entering OPS 2 
from any OPS except OPS 8. Otherwise, the 
crew must select CNCL via an ITEM entry. 


Manual Attitude Control 


The RHC controls roll pitch, and yaw 
movements on orbit with the OMS and RCS. 
Flight characteristics depend totally on DAP 
configuration. Various DAP configurations have 
been optimized for certain tasks, using off-line 
simulation. With the DAP mode in INRTL, and 
DISC RATE selected on panel C3 or A6U, 
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deflecting the RHC out of detent fires 
appropriate RCS jets until an angular rate is 
achieved in that axis equal to the rate specified in 
the DAP CONFIG display (SPEC 20). Different 
rates may be specified for DAP A and B, and for 
PRI or VERN jets. When the rate is achieved, the 
jets are turned off until the RHC is returned to 
detent or deflected in another axis. Jets also fire 
to maintain attitude or rates within selected DAP 
CONFIG deadbands. Returning the RHC to 
detent snapshots the attitude, and jets are fired to 
stop rates and hold the snapshot attitude. 


Deflecting the RHC beyond the soft stop causes 
jets to fire continuously, producing a constant 
angular acceleration. When the RHC is 
repositioned inside the soft stop, jets are turned 
off, but rates continue until the RHC is returned 
to detent. 


With PULSE selected, RHC deflection fires jets 
to achieve the angular rate change specified by 
rotational pulse (ROT PLS) on SPEC 20. PULSE 
is also a free drift mode. 


High Rate Attitude Maneuvers 


To quickly maneuver to attitude in an 
emergency, a high maneuver rate may be 
required. With the appropriate DAP 
ROTATION in DISC, bump the RHC past the 
soft stop and back within the soft stop several 
times until the desired rate is achieved, being 
careful not to let the RHC return to detent. Stop 
the maneuver by returning the RHC to the 
detent. It will be necessary to lead the desired 
attitude by an amount proportional to the 
rotation rate. 


Flying Techniques for COAS/HUD 
Calibrations and HUD IMU Alignments 


To perform a HUD (or COAS) calibration or 
IMU alignment using the HUD, the orbiter must 
be maneuvered manually to align the HUD test 
pattern (or COAS reticle) with a preselected 
star. The largest portion of the maneuver will 
be performed using a coarse control DAP with 
rates and deadbands selected to minimize 
maneuver time without exceeding propellant 
allotments. 
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Once the star is near the proper location in the 
HUD test pattern, the crew must switch to a 
DAP optimized for fine attitude control. A 
vernier DAP will provide the finest attitude 
control with minimum fuel consumption. 


Patience is very important when attempting to 
properly locate the star in the HUD test pattern. 
After making an RHC input, wait until 
movement is noticed, and the star is near the 
desired position before releasing the RHC. This 
will minimize jet firings and fuel consumption. 
The coarse control DAP will usually allow 
higher maneuver rates than the fine control 
DAP. The higher rates require more time to 
start and stop so pilots will notice a requirement 
to lead RHC inputs when using the coarse 
control DAP (i.e., return the RHC to the center 
detent slightly before the star reaches the 
desired position in the HUD). 


Translation 


Orbit translation maneuvers can be conducted 
using the OMS engines or RCS jets. The OMS 
engines are usually used for larger maneuvers. 
Burn targets for preplanned orbit OMS or RCS 
burns are normally transmitted to the crew 
from Mission Control. The crew will then load 
those (or verify auto-loaded) targets and 
execute the burn at the appropriate time. 
OMS/RCS burn monitoring and control for 
orbit burns is similar to that discussed in 
Section 7.3. 


RCS Translation 


The RCS is used to control translation when 
small velocity changes are required. For 
example, the RCS might be used for the initial 
maneuvers used to separate from a payload 
after deploy. In these situations, the CDR/PLT 
uses the THC and DAP panel to transmit 
control commands to the GPCs and ultimately 
to the RCS jets. 


Translation flight characteristics depend on 
DAP panel configuration and the DAP 
parameters listed on the DAP CONFIG display. 
DAP parameters are optimized for planned 
tasks preflight, using off-line simulation. 


THC deflection with PULSE selected on the 
ORBITAL DAP panel fires jets to cause a 
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velocity change as specified on SPEC 20. 
Selecting NORM allows continuous acceleration 
as long as the THC is deflected. HIGH Z is a 
submode available for +Z translations only. 
Selection of this submode fires all nine upfiring 
jets and should be used only in an emergency. 


LOW Z is a submode that allows +Z translations 
by firing +X and -X jets simultaneously to 
minimize payload/Space Station pluming. 
LOW Z translations also affect pitch and roll, 
since upfiring jets are inhibited. There are 
significant translational cross-coupling effects in 
this mode. 


Rendezvous/Proximity Operations 


Rendezvous and proximity operations require 
coordinated attitude and translation maneuvers 
to join with or maintain a position relative to 
another orbiting object. This section covers 
some of the tasks and problem areas 
encountered during rendezvous and proximity 
operations along with some suggested tech- 
niques. The normal rendezvous sequence is 
presented in the orbit mission events summary 
in Section 5. For a more detailed discussion of 
Rendezvous/ Proximity Operations, refer to the 
Rendezcous Concepts CBT Lesson. 


Plume Impingement 


For translations near targets, there is a concern 
about contamination and also the induced body 
rates and torques caused by an RCS jet plume 
striking the target. Certain types of payloads 
may be sensitive to propellant contamination. 
For example, a payload with delicate optical 
equipment could be damaged by the plume from 
an RCS jet at a short distance. Selecting which 
jets to fire, as well as distance and orientation of 
the orbiter with respect to the target, may be 
adjusted to reduce contamination. 


Nearly all payloads are sensitive to the force 
and resultant body rates/torques caused by an 
RCS jet firing at close range. Usually, a sphere 
of influence is identified, and no upfiring jet 
firings at the target are allowed within it; 
typically, 200 ft to grapple range for small 
payloads and 1000 ft. for large payloads and 
stations. 
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Braking Techniques 


Braking is used to reduce relative velocity 
between the orbiter and a target. Three tech- 
niques will be discussed: Norm Z, Low Z, and 
orbital mechanics effects. 


Norm Z braking uses upfiring jets to generate 
braking in a +Z direction. Since the jets 
pointing toward the target provide the braking 
force, plume impingement is a concern. 


Low Z reduces plume impingement by using 
the cant of the +X jets and scarfing (design of 
the nozzle) of the -X jets to produce a resultant 
force in the +Z direction. Low Z braking can 
use up to 12 times the amount of propellant as 
Norm Z. This mode should only be used where 
plume impingement must be minimized. When 
in Low Z, Y-axis jet firings induce higher 
closing rates, requiring expensive braking 
maneuvers. 


CAUTION 


Due to cross-coupling effects, minimize Y- 


axis translations when flying in low Z 
mode (increases closure). 


Orbital mechanics may provide small separa- 
tion forces for various approaches. This may be 
used effectively for plume-sensitive targets and 
to help minimize propellant usage. The best 
illustration of this concept is the +R-bar 
approach, where “natural” braking (slowing of 
the orbiter) lessens the requirement for 
+Z thrusting. 


Stationkeeping 


Stationkeeping is the technique used to 
maintain the orbiter at a desired relative 
position, attitude, and attitude rate with respect 
to a target vehicle. When stable in a station- 
keeping position, the crew has time to obtain 
navigation information and determine and set 
up approach maneuvers. Stationkeeping most 
commonly is performed on the target’s velocity 
vector (V-bar) or the radius vector of the target 
to the center of the Earth (R-bar). 


V-bar stationkeeping can be accomplished 
either ahead of (+V-bar) or behind (-V bar) the 
target. For a given range V-bar stationkeeping 
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uses less prop than R-bar stationkeeping since 
both the orbiter and the target are nearly in the 
same orbit. 


869.cvs 


V-Bar Stationkeeping 


This results in the most efficient type of 
stationkeeping because minimal propellant is 
required to maintain the orbiter at the same 
altitude and coplanar with the target. At about 
600 ft on the V-bar, position can be maintained 
for about 100 pounds of propellant per orbit, 
using optimum techniques. 


Similarly, R-bar stationkeeping can occur either 
below (+R-bar) or above (-R-bar) the target. 


870.cvs 


R-Bar Stationkeeping 
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This is an unstable configuration, since orbital 
mechanics effects will result in the orbiter and 
target changing their relative positions over an 
extended period. R-bar stationkeeping is more 
complex and requires higher propellant usage. 
About 0.5 lb/ft range per rev, above and 
beyond V-bar usage, is required (600 ft. = 400 
Ib/ orbit). 


Stationkeeping position is maintained using the 
COAS, rendezvous radar, lasers, and CCTV 
triangulation. The crew must judge when atti- 
tude and translation corrections are necessary 
and make corrections manually. Typically, 
attitude is controlled by UNIV PTG so the crew 
has only translation corrections to maintain 
position. 


For convenience, stationkeeping operations are 
classified by range (close in, short, medium, and 
long). There are significant differences between 
techniques used at different ranges. 


RANGE DISTANCE 


Close in 35 - 200 ft 
Short 200 - 1000 ft 


Medium 8 miles 


Long 40 miles 


Stationkeeping Ranges 


7. TRAJECTORY MANAGEMENT 
AND FLIGHT CHARACTERISTICS 
7.2 Orbit 


USA007587 
Rev. A 


Close In 


Close in techniques are required after the orbiter 
has achieved a stable position near the target. 
Alignment with the desired target axis may or 
may not have been completed. Orbital 
mechanics effects are minimal, and flying is done 
using a combination of out-the-window and 
CCTV cues. Most payloads will use Low Z 
operations in this area. 


NOTE 


Low Z requirements are defined for each 
rendezvous mission so may vary from 
these generalized descriptions. Close in 
stationkeeping requires constant attention 
by the crew. A flyaround or matching the 
target’s rates may be required to affect a 
capture. 


Short Range 


Short range techniques are used after the orbiter is 
positioned on the desired target axis or 
immediately after target deploy. Orbital 
mechanics effects cannot be ignored, and plume 
impingement must be considered for larger 
payloads (HST, Station). The primary tasks are 
matching attitude rates and translating to 
maintain correct relative position on the desired 
target axis. 


7 
2 


Stationkeeping WRT inertially stabilized target 


These require visual translation guidance 
techniques that can be described by three types of 
targets: inertially stabilized, fixed in LVLH frame, 
and arbitrary rate. 


Inertially stabilized targets usually have some 
type of control system or are spin-stabilized. To 
keep the same relative geometry, the orbiter 
must also maintain inertial hold. This requires 
a constant translation to stay in the desired 
orientation to the target and maintain the 
desired range. Procedurally, UNIV PTG and 
the DAP: INRTL are used to automatically 
maintain inertial hold, while the crew uses the 
THC to maintain the -Z orbiter axis pointed at 
the target at the desired range. 
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Orbiter stays in same LVLH 
position (on target V-bar) 


Stationkeeping WRT target rotating in inertial frame 
at orbital rate (i.e., target attitude fixed relative to 
LVLH frame) 
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LVLH Stationkeeping 


Some targets may be maintaining a constant 
attitude relative to the LVLH reference frame 
and therefore rotating in the inertial frame at 
orbit rate. The target may have an active or 
passive (gravity gradient) control system. 


The orbiter maintains a fixed position and 
attitude with respect to the target’s LVLH 
reference frame. Procedurally, UNIV PTG or 
LVLH is used to automatically control attitude, 
and translation is controlled manually. Since 
LVLH stationkeeping is much more stable than 
inertial, fewer translation inputs are required to 
maintain position. 


Should the target lose its control system, 
causing it to rotate at an arbitrary rate about a 
principal axis of inertia, stationkeeping becomes 
more difficult. Either an inertial or LVLH mode 
may be used, depending on the situation. 


Medium Range 


Medium range stationkeeping may be required 
during long-term payload ^ checkout/ 
troubleshooting or recovery from an orbiter 
malfunction. Burns are targeted by MCC or 
onboard using NAV state data. Attitude 
maneuvers are performed using the AUTO 
DAP. The radar should provide relative 
position information. One technique, called a 
“football,” attempts to keep the orbiter within 
some predefined boundary centered at some 
range on the V-bar. When the orbiter 
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approaches а boundary, a maneuver 15 
performed to drive it back to the center. This is 
repeated as required. Orbital mechanics effects 
can be used to maintain the “football” with 
minimal maneuvering required. 


Long Range 


Long range stationkeeping is typically done at 40 
n. mi. (or greater). This is usually done to 
support a possible rendezvous at some later time 
in the mission (similar to HST deploy). This 
stationkeeping is usually maintained by ground 
targeted coelliptic (NSR burns) and is done on 
the V-bar. 


Prox Ops Techniques 


Whenever possible, use the DAP and UNIV 
PTG to automatically maintain attitude. Select 
vernier jets for attitude control to conserve fuel. 


Aim for an “ideal” target position in the -Z 
COAS reticle. Typically this is in the lower half 
of the COAS to keep the CGs close. 
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COAS Sight Picture 


Translate using the THC to maintain this 
position. Small inputs and patience аге 
essential. When rates are low, use the smallest 
translational pulse size available. Use vernier 
jets for attitude control. Maintain the payload 
in an imaginary box, sized to reflect attitude 
deadbands, about the “ideal” position and 
translate only when the target moves out of a 
self-imposed box which is about two times that 
attitude deadbands. 


NOTE 


It is more important to null the rates in 
the COAS (keep it stationary) than to 
“drive” it to the “ideal” position. 


This will reduce fuel consumption and take 
maximum advantage of orbital mechanics effects. 


Use radar and REL NAV (SPEC 33) to maintain 
distance and range rate. 


NOTE 


The tendency is to focus on keeping target 
position fixed in the COAS. A good scan 
and crew coordination are necessary to 
control range rate and maintain distance. 


Transition 


Transitions are maneuvers that maintain the 
orbiter at a constant distance from the target 
while it moves from one position to another. 


7. TRAJECTORY MANAGEMENT 
AND FLIGHT CHARACTERISTICS 
7.2 Orbit 


The orbiter will continue pointing a specified 
body vector (usually -Z) at the target. In 
contrast to a flyaround, which requires the 
orbiter to actually fly around the target in an 
inertial sense, a transition involves moving the 
orbiter around the target in a target-centered, 
rotating LVLH reference frame without regard 
to the target’s inertial attitude. Transitions can 
be completed by placing the orbiter in inertial 
attitude hold with the -Z axis pointed toward 
the target (inertial stationkeeping), or by 
pitching the orbiter (tail up or tail down). 


Flying a transition from the +V-bar to the -R-bar 
(90° of the orbit) using a pitch maneuver is 
similar to inertial stationkeeping for М of an 
orbit. Which transition is selected depends on 
propellant or time/lighting concerns. 


Separation 


Translating away from another object requires 
establishing an opening rate between the 
bodies. Usually, relative state vectors are well 
known, апа a planned sequence can Бе 


followed to minimize propellant usage. 
However, payload sensitivity to plume 
impingement and payload control system 


characteristics tend to complicate separation 
maneuvers. Long- and short-term recontact 
must be considered; therefore, some separation 
sequences require multiple separation 
maneuvers. Separation is usually performed in 
two stages. A small separation burn (< 1 fps) is 
performed to start opening, then a larger burn 
is performed when the orbiter is further away. 


Cross-Coupling Effects 


Because the thrust of the RCS jets is not through 
the orbiter c.g, commanded translation/ 
rotation maneuvers in one axis tend to induce 
motion in other axes, which is called “cross- 
coupling;” it can have a significant impact 
during rendezvous manual phase апа 
proximity operations. 


With the orbiter on the target V-bar, tail-to- 
Earth, and payload bay toward target, the crew 
should be aware of cross-coupling effects, as 
follows: 
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е NORM ROLL: Affects every degree of 
freedom. Much worse in LOW Z than 
NORM 2. 


e NORM +X: Induces braking (+Z) 
translations, and pitch cross-coupling. 
When flying Prox Ops, use the 1 to 5 
Rule: 1 +Z input for every 5 +X inputs. 


е NORM -Z: Significant +X translation. 


e LOW Z +Z: negative pitch cross 
coupling, translation pulse may loose 
half its force due to counteraction of 
attitude firings when in attitude hold. 


e LOW 2 + У: In attitude hold, major clos- 
ing (-Z) rates induced, more than half the 
size of commanded Y-axis translation. 


e ROLL/PITCH deadbanding: using 
Primary jets, induces a small opening 
(+Z) rate. In LOW Z, causes a major 
closing (-Z гаје. Minus pitch also 
produces a significant +X translation 
when in LOW Z. 


e TAIL ONLY: A control mode used to 
conserve forward RCS propellant. Pitch 


maneuvers induce a powerful Z 
translation and a significant +X 
translation. Yaw induces a powerful Y 


translation and noticeable X and Z 
translations. All other control mode 
effects are identical to normal control 
(NOSE and TAIL). 


e NOSE ONLY: For pitch, translational 
effects are mirror image of TAIL ONLY, 
except no X effects. Yaw is also 
opposite to TAIL ONLY, but 
significantly reduced. (NOSE-ONLY is 
rarely used.) 


These effects point out the requirements for 
patience after performing translation pulses. 
Crewmembers should learn how to separate 
translational motion from deadbanding (keep 
ADI needles and UNIV PTG in your scan) Cross 
coupling must be understood. Techniques are 
developed through practice in simulation 
facilities. 
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Vernier jets, when used for attitude control, 
induce their own cross-coupling effects. Even 
though verniers produce much smaller forces 
than primary jets, their geometry is even more 
awkward. All vernier firings induce transla- 
tional cross-coupling in the -Z direction. This 
can induce significant downtrack errors in 
orbiter position that are important during 
rendezvous over long periods. This “vern- 
effect” can cause unwanted closure during prox 
ops. 


NOTE 


The crew must closely monitor R-dot 
using all ranging devices (CCTV, radar, 
laser, COAS) to avoid undesirable closing 
rates. 
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Orbit Rules of Thumb 


• In propellant-limited situations, use the 
following guidelines: 


— Use Verns for attitude hold and ALT 
DAP for attitude maneuvers. 


— To conserve forward RCS, use TAIL 
ONLY control mode. 


— ProxOps 
— Null rates (all axis) 


- Null out of plane velocity at the 
node 


- Do not confuse deadbanding with 
translation 


- Anticipate (do not fight) orbital 
mechanics effects 


- Range rate is the most important 
parameter 
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Overview of Entry Flying Tasks 


The entry phase of flight covers the transition 
from Earth orbit to the end of landing rollout. 
Guidance phases for portions of the entry 
phase are deorbit burn guidance, entry guidance, 
TAEM guidance, and approach/land guidance. 


Monitoring 


Crew monitoring of performance is required 
throughout entry. This subsection presents the 
information necessary to monitor and control 
the vehicle during the deorbit burn and entry 
phases of guidance. This task consists of 
monitoring vehicle displays to determine if 
guidance, navigation, and flight control are 
performing correctly and taking action, if 
required, to ensure a safe landing. An in-depth 
knowledge of how these systems work, along 
with an understanding of the reference 
trajectory and orbiter flight control system 
(FCS) will enable crewmembers to recognize 
off-nominal situations and correct them before 
serious performance or control problems 
develop. 


Takeover 


Takeover rules and criteria are described in the 
Flight Rules. Interpretation of onboard 
information will aid the crew іп their 
assessment of when to manually intervene. 
From the available information, the crew 
assesses the performance of the automatic 
guidance system and remains prepared to take 
over with manual guidance for off-nominal 
situations. Some of the conditions requiring 
crew takeover are: 
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e Navigation errors 

e L/D dispersions 

е Atmosphere variations 
® Winds 

• Deorbit execution errors 
® GNC failures 

e Degraded performance 


Any of these conditions, if left uncorrected, 
could lead to unrecoverable range problems or 
loss of vehicle control. 


Guidance and flight control perform well. It is 
highly unlikely manual takeover will be 
required. MCC is also available to help with a 
ground controlled approach (GCA). 


Manual Control 


In some instances, the crew will be required to 
take manual control and fly the orbiter. The 
Deorbit Burn and Entry sections contain the 
basic principles for CSS flying, although these 
portions of the flight profile are normally flown 
in AUTO. Manual flight control is the normal 
mode of operation from .96 Mach until the 
completion of rollout. (This portion of the flight 
profile is discussed in detail in Section 7.4.) 
Self-generated guidance based on navigation 
information will be discussed, but if guidance is 
good, flying the error needles in CSS will result 
in the most consistent tracking of the planned 
entry trajectory. 


Deorbit Burn 
Monitoring 


Normally, the deorbit burn will be flown in 
AUTO using both OMS engines. The OMS 
engines are gimballed to control orbiter attitude 
in all three axes. Capability exists to downmode 
from both OMS engines to one OMS engine, to 
the aft +X RCS jets, or to the forward -Х RCS jets. 
The burn time of ignition (TIG) is selected to 
protect for one OMS engine failure at TIG or at 
any time during the burn. A single OMS engine 
can control pitch and yaw, but roll must be 
controlled by the RCS. If flight control does not 
recognize the OMS engine failure, control will be 
sloppy but acceptable. Deorbit burns using the 
RCS only must be flown manually. 
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The DEORBIT BURN, DEORBIT BURN 
MONITOR, and the DEORBIT BURN FLIGHT 
RULES cue cards are used to determine the 
required actions for malfunctions affecting the 
burn. The philosophy embodied in these cards is 
to either safely complete the burn or stop the burn 
above a safe altitude. 


The ADI error needles are used to monitor 
guidance and control during deorbit burns. The 
body axis burn velocity components (VGOx, 
VGOy, and VGOz), along with ТСО and 
AVTOT, should also be cross checked. 
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DEORB MNVR Display 


Monitoring the VGOs in addition to the error 
needles provides insight into the status of 
guidance during the burn. The TTG field will 
blank when the orbiter is in burn attitude. The 
УСОх prior to TIG will be 80% of AVtot when 
the vehicle is in burn attitude. To monitor burn 
progress, the crew can watch VGOs, HA, and 
HP during the burn. The VGOs display how 
much AV is left to go in orbiter body axis 
coordinates. For any OMS or +КС5 burn, most 
of the burn should be in the appropriate X 
direction. НР will gradually increase or 
decrease, depending on whether the OMS burn 
is posigrade or retrograde. For deorbit burns, 
HP should always decrease. 


WARNING 


Since the flight controller power is ON, the 
RHC is "hot" during an OMS burn. The 


DAP will mode to manual (INRTL) if the 


RHC is bumped. The message "DAP 
DNMODE КНС” will be annunciated. 
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An SM alert and "DAP DNMODE RHC" 
message will annunciate with OI-28 and subs 
software. 


NOTE 


Propellant-wasting, out-of-plane deorbit 
burns will have a PEG 7 delta Vy (LVLH) 
component. If no propellant is wasted 
then the PEG 7 delta Vy is typically zero. 


OMS burn thrust vector control (ТУС) is 
calculated independently from the ADI error 
needles. 


е OMS ТУС gimbals the OMS engines to 
null vehicle rates and point sensed 
thrust in the desired AVTOT direction. 


* ADI error needles display vehicle 
attitude error from the attitude that 
would point the net thrust through the 
c.g., as defined by the trim angles, and 
in the desired ЛУТОТ direction. If trim 
angles are incorrect or flight control 
does not recognize an engine failure, the 
ADI error needles will not display 
correct error information. 


For a +Х RCS burn, the ADI error needles are 
correct, as long as flight control recognizes that 
it is an RCS burn. Error needles are never 
correct for a -X RCS burn. 


Approaching cutoff, the crew should monitor 
current HP approaching targeted HP, TGO 
approaching zero, and AVTOT approaching 
zero. If TGO goes to zero, and the OMS engines 
do not cut off (chamber pressure zero and 
engine valves closed), the OMS engine switches 
should be turned OFF to prevent an overburn. 
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МОТЕ 


OMS guidance will cut off, based оп 
VGOX. If out of attitude, there will be 
large residuals in VGOY or VGOZ after 
the burn is complete. VGOZ residuals 
should be trimmed by the CDR using the 
THC, per the Deorbit Burn cue card 
procedure. 


If an early cutoff occurs, the appropriate 
procedure from the Deorbit Burn cue card 
should be executed to achieve deorbit targets. 
OMS propellant, aft RCS, forward RCS, and 
prebank may be used to recover the underburn. 
If the underburn magnitude exceeds RCS and 
prebank capability, landing site redesignation 
may Бе required. For more detailed 
information оп OMS burn downmoding, 
consult the appropriate Flight Procedures 
Handbook. 


Takeover 


Deorbit burns are normally flown in AUTO 
flight control and are started and stopped by 
GPC commands. Duration of the burn, as well 
as maintaining proper attitude during the burn, 
are the two most important criteria. 


If while perigee is still above SAFE HP a failure 
occurs that severely impacts OMS capability, 
the crew will stop the burn. SAFE НР 
guarantees at least 24 hours of orbit time, which 
MCC can use to properly retarget the deorbit 
burn and assess the impacts of the failure. 


On the other hand, if the failure occurs below 
SAFE HP, the crew must do what they can to 
complete the deorbit burn, which includes 
using the aft and forward RCS and possibly a 
recovery prebank. 


Given a normal doerbit burn, EI targets will be 
met within allowable tolerances if the post burn 
residual AV is within 2 fps. Specifically, a 2 fps 
underburn equates to a 30 nautical mile (n. mi.) 
energy error at EL which is well within 
guidance capability. 


A 3? attitude deadband is used in the TRANS 
DAP. Attitude error or deviation greater than 
3? prior to the burn indicates a flight control 
malfunction. The crew should check ITEM 27 
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on the MNVR display or downmode to MAN 
DAP and maneuver back to ignition attitude. 
The deorbit burn attitude is entered in a 
controlled, timely manner, and the burn can be 
postponed for an unacceptable attitude error. 


Deadband in the ТУС DAP is very small. If 
ignition has occurred, a manual takeover 
should be performed for unexplained devia- 
tions greater than 5°. 


NOTE 


Engine out transients may cause а 
momentary attitude deviation greater 
than 10°. These transients are an excellent 
confirmation of an engine out. Manual 
takeover should not be required. 


Manual Control 


Fly the error needles or the ADI REF ball if 
available. Cross-check the VGO components. 
During OMS TVC DAP attitude maneuvers, 
keep rates reasonable (less than 2 deg/sec). 
Approximate УСО component fractions of 
DVTOT depend on the type of burn. If only one 
OMS engine is used, yaw the vehicle about 10? 
into the good engine. Normally, manual flight 
control during an OMS burn requires very few 
RHC inputs once the guidance needles are 
centered, and the TVC DAP begins attitude hold. 


For an RCS-only burn, the attitude deadband is 
3°, and the burn is flown manually using the 
RHC for attitude control and the THC for the 
burn with four +X aft RCS jets. 


One technique for +Х RCS burns is called the 
Patterson Maneuver. Неге, the crew first 
maneuvers the vehicle to the proper burn 
attitude, as displayed on the MNVR EXEC 
display. Then they pitch the nose up 3° high. 
So, when they start the burn with the THC, the 
vehicle will pitch down to the correct attitude, 
since aft RCS jets are above the c.g., and the 3° 
deadband will hold it there. A variation on the 
technique is to start the burn in attitude, allow 
the vehicle to pitch down toward the 3° 
deadband limit, then pitch up 6° to the other side 
of the deadband. The vehicle will slowly pitch 
back down and hold the desired attitude. 
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It is also acceptable to just keep the needles 
centered using small RHC inputs. This tech- 
nique requires constant inputs in pitch and will 
use more propellant to hold attitude, but is 
easier to remember than the Patterson maneu- 
ver. For short RCS burns, the extra propellant 
usage is minimal. 


The VGO ratio table below lists appropriate ratios 
of VGOxyz to VTOT for different burn 
maneuvers. 


BOTH L (В) +X 
OMS OMS RCS 


1/5 С 15) 
14 


УСО Ratios 


МОТЕ 


А BFS OMS burn is targeted in the same 
manner as PASS, but must be flown 
manually. 


Entry 


Monitoring 


During the entry phase, guidance provides 
steering commands for trajectory control from 
initial penetration of the atmosphere (about 
400,000 ft) at a range of about 4100 n. mi. from 
the landing site, until TAEM (2500 fps, about 
60 п. mi. from landing site at an altitude of 
about 80,000 ft). The primary objectives of entry 
guidance are: 


* Guide the orbiter along a path that 
prevents exceeding structural, thermal, 
and stability design limits. 


e Deliver the orbiter to a satisfactory 
energy state and vehicle attitude at 
initiation of TAEM guidance. 


Entry guidance is based on drag control. The 
correct drag level is calculated, based on Mach 
(velocity) and range. Bank is then used to 
control lift until the desired drag is established. 
Entry trajectory constraints are shown in the 
following chart. 
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Entry Trajectory Constraints 


Entry navigation (NAV) computes the orbiter's 
position, velocity, and distance/ direction to the 
landing site. NAV also computes Mach, q-bar, 
and alpha. There are numerous interfaces 
between NAV and flight control. The crew 
optimizes NAV performance by accepting or 
inhibiting five types of sensed data: drag-H, 
TACAN, air data, MLS, and GPS. Bad NAV 
information can cause flight control problems, 
since NAV information is used to tailor flight 
control for the varying flight regimes 
encountered. Mission Control monitors navi- 
gation performance during entry using tracking 
data. TACAN and air data should not be 
accepted to МАУ, or air data accepted to G&C 
without a go from Mission Control, unless 
communication capability is lost. 


WARNING 


Large NAV errors can cause loss of vehicle 


control, because NAV data are used to 
select control effectors and set control 
gains. 


Dedicated instruments, DPS displays, and cue 
cards are available to assist the crew in 
monitoring entry performance. The ADI, 
alpha/Mach indicator (AMI) апа the 
altitude/vertical velocity indicator (AVVI) are 
the primary dedicated instruments for 
monitoring entry performance. Five ENTRY 
TRAJ displays are available for monitoring 
entry guidance. ENTRY cue cards are used as 
references to compare actual and predicted 
performance. 
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After the deorbit burn, the crew transitions to 
MM 303 and maneuvers to the EI-5 attitude that 
was uplinked with the deorbit targets and 
voiced up in the DEL PAD. 


During the early part of entry, the RCS 
command lights are a good indication of DAP 
activity. If the crew transitions to MM 304 at 
Е1-5, the vehicle will be very close to attitude, 
and only occasional jet firings will occur as 
attitude drifts back and forth between DAP 
deadbands. If the crew is late transitioning to 
MM 304, or if an attitude error has been 
allowed to develop while working system 
problems, a large number of jet firings can 
occur. Up to 250 Ib of RCS propellant can be 
wasted. Crews should closely check that the 
orbiter is in the proper attitude prior to MM 
304. 


From q-bar = 0 to q-bar = 0.5, the RCS only is 
used for attitude control. From q-bar = 0.5 
(12 KEAS) to q-bar = 8.0 (48 KEAS), the elevons 
will trim in response to pitch jet firings. А4 
q-bar = 2.0 (24 KEAS), the elevons are used for 
control. At q-bar = 40 (109 KEAS), the pitch jets 
are turned off. 


At q-bar - 10 (54 KEAS), the roll jets are 
deactivated. Yaw jets continue to fire for bank 
control until Mach is less than 1.0. Yaw jets 
should fire from both pods at a similar rate 
(symmetric firings). 


At q-bar = 50 (122 KEAS), the RCS PITCH and 
ROLL activity lights are reconfigured. Illumination 
of the PITCH light indicates elevon or aileron rate 
saturation. Three or more yaw jet commands turn 
on the ROLL light. The yaw jets are terminated at 
Mach 1. The PITCH jet light will continue to 
indicate elevon and aileron rate saturation. 
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Orbiter performance during bank maneuvers is 
the pilot’s cue to dynamic stability characteris- 
tics. The two most important factors the crew 
must monitor are YAW jet activity lights and 
roll rate. The first roll command is at 3 deg/sec; 
subsequent roll reversals are commanded at 5 
deg/sec. Тһе rate of roll maneuvers is 
important to minimize H-dot and drag 
excursions. Prompt execution of roll commands 
will minimize the bank angle required to 
establish the desired drag profile. 


Using the ADI, AMI, and AVVI, in conjunction 
with the ENTRY ALPHA cue card, allows the 
crew to monitor vehicle performance relative to 
pre-mission planned trajectory. | Comparing 
alpha, range, altitude, H-dot, and roll reference to 
actual values is a good crosscheck on guidance. 
The data on this card is flight (and planned 
entry) specific, but most of the data is useful on 
any entry. The only data that changes 
significantly is the direction of Rref (reference roll 
angle). The magnitude of Rref does not change 
much. 


ENTRY ALPHA Cue Card 


Five DPS displays are the primary displays for 
entry monitoring or manually flying entry. 
ENTRY TRAJ 1 appears at MM 304 (OPS 304 
PRO). TRAJ 2 through 5 appear at predeter- 
mined velocity breakpoints. Each display is a 
continuation of the previous one. 


In the center of the ENTRY TRAJ display there 
is a dynamic plot of velocity (Y-axis) vs. range 
(X-axis). An orbiter “bug” is placed on this 
display as a function of range and velocity. The 
dashed drag lines are used to determine the 
desired drag for the current range and velocity. 
Interpolation is required. For example, the 
orbiter bug on TRAJ 1 shows desired drag of 
14 fpss. 
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ENTRY TRAJ 5 Display (Mach 5-Mach 2.5) 


NOTE 


On TRAJ 4 and 5, the orbiter bug is placed 
by energy (E/W) vs. range. This difference 
does not change the operational use of the 
displays. 


NOTE 


Desired, reference, and commanded drag 
are interchangeable terms; they mean the 
same thing. 


The entry guidance algorithm is also running 
real time to calculate desired drag. The output 
of this algorithm is indicated by the arrow on 
the drag scale (left side of the ENTRY TRAJ 
display). Remember, the arrow points to where 
you want to be. 
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The current drag, as sensed by Ше IMUs, is 
displayed as a triangle on the TRAJ display. 


Guidance commands a roll angle that will 
dump lift as required to achieve the desired 
drag. H-dot control is an essential part of this 
operation. Guidance will bank until it sees an 
acceptable H-dot, then bank to an H-double-dot 
that equals zero to maintain this H-dot. 


The desired H-dot is a function of reference 
H-dot and drag error. Reference H-dot is the 
H-dot required to maintain desired drag. | 
current drag is less than reference drag, 
guidance will fly to a higher H-dot (more 
negative). 


Guidance displays reference H-dot on the lower 
right corner of the TRAJ display. The crew can 
also look directly below the orbiter bug and 
read a rough estimate of reference H-dot at the 
bottom of the TRAJ display. 


Entry guidance will also modulate alpha to 
remove drag errors. By changing alpha +3°, 
guidance can instantly change the drag by 
about 10 percent (3 degree modulation is the 
limit). Alpha modulation is much faster than 
roll control If guidance is using alpha 
modulation to remove drag errors, it will roll to 
achieve an H-dot that will eventually put the 
orbiter in the correct air density. In a few 
minutes, the drag error will be removed 
without using alpha modulation. 


As the orbiter bug proceeds down the trajectory 
lines, it leaves triangular trailers every 15 
guidance cycles (28.8 sec) that are used for trend 
analysis. For ENTRY TRAJ 3, 4, and 5, the 
trailers are displayed every 8 guidance cycles 
(15.36 sec). Only six trailers can be displayed at 
one time. 


A guidance box appears upon initiation of 
closed loop guidance and moves relative to the 
shuttle symbol to reflect drag errors (D-Dmzr). 
The guidance box leaves trailer dots. Ideally, 
the nose of the shuttle symbol will be inside the 
box, and a dot will be located in every triangle. 
The first roll command will be visible on the 
TRAJ display shortly after the initiation of 
closed loop guidance. Timely execution of the 
first roll command will minimize the bank angle 
required to establish desired drag. 
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If the guidance box is to the left of the shuttle 
symbol, drag is too small (you will land long) 
and the guidance trend is toward high energy. 
The opposite condition indicates drag is too high. 


Alpha is monitored on the Ascent/ Entry Flight 
Displays (AFD) and on the ENTRY TRAJ 
displays. These parameters should Бе 
compared with the values on the ENTRY 
ALPHA cue card. ENTRY TRAJ displays 
reference alpha (computed by guidance) via an 
arrow and nav-derived (actual) alpha by a 
triangle. Normally, these overlay each other. 
However, guidance will add small biases to 
alpha to remove drag errors. If the ADI pitch 
error needle is centered and the alpha triangle is 
offset from the arrow, it is an indication of alpha 
modulation. Alpha modulation is expected 
during and after a roll reversal. 


Heading error is defined as delta azimuth (DEL 
AZ or AAZ on the ENTRY TRAJ displays) and 
is the angle between the velocity vector and the 
great circle direction to the runway. DEL AZ is 
displayed on the HSI as the difference between 
the “H” pointer and the lubber line. There is 
also a digital value of DEL AZ right next to the 
HSI and on the ENTRY TRAJ displays. Bank 
angle controls drag, and therefore energy, 
during entry. Because the bank angle causes 
the orbiter to continually turn, a crossrange 
capability of approximately 750 п. mi. can be 
obtained. This gives the orbiter the advantage 
of using landing sites that are not directly under 
the orbital groundtrack. Roll reversals are 
performed to keep DEL AZ within limits. The 
velocities at which the reversals occur are a 
function of crossrange. 


Several onboard indicators alert the crew that a 
roll reversal is needed: on the ENTRY TRAJ, 
the orbiter bug and phugoid damper start 
flashing; on the HSI, the box surrounding the 
digital DEL AZ value turns red and flashes; on 
the ADI, the roll error needle indications a full 
scale deflection. The first roll reversal will 
occur at a DEL AZ of 10.5°. Subsequent roll 
reversals occur at a DEL AZ of 17.5° until Mach 
= 4 when DEL AZ limit ramps to 10.0 by Mach 
2.8. 


The ENTRY MANEUVERS cue card itemizes 
important events that the crew must monitor 
during entry. Off-nominal activities are 
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indicated by asterisks (*). Crew action items are 
keyed to velocity. Items to be verified only are 
marked with a check (5). 


See section 5.4 for more detail on this card. 


NOTE 


V in Kft/sec is equal to Mach; e.g. 
V=10K=Mach 10. 


Automatic program test inputs (PTIs) may be 
included as part of entry trajectories to obtain 
aero data postflight. These data are used to 
further define the aerodynamic characteristics 
of the shuttle, help expand the operational 
envelope, and reduce aero data base 
uncertainties. PTIs are executed automatically 
by the entry DAP and are input into the flight 
controls downstream of gains and filters so that 
a known control deflection or jet firing can be 
made. The crew enables PTIs on SPEC 50, and 
flight control must be in AUTO. Execution of 
PTIs is monitored on the SPI and GNC SYS 
SUMM 1 for control deflections, by the RCS 
activity lights for jet firings, and by data on the 
PII Monitor Cue Card. Normal vehicle 
performance parameters also must Бе 
continuously monitored to ensure there is no 
trajectory degradation introduced by the PTIs. 


Takeover 


The entry trajectory is normally flown in AUTO 
until subsonic, when the crew modes to CSS. 
Upon moding the GPCs to MM 304, dedicated 
displays and ENTRY TRAJ displays become 
available. DAP controls for the AEROJET DAP 
are located on each eyebrow panel. Manual 
takeover can be executed using the pushbuttons 
or by moving the RHC more than 7? out of 
detent. 


NOTE 


During entry, moding to CSS is separate 
for the pitch axis and roll/yaw axes. It is 
possible to be in CSS pitch control and 
AUTO roll/yaw or vice versa. 


Low Energy 


A ROLL REF "down" arrow on the ENTRY 
TRAJ display indicates a low energy condition. 
In addition to the down arrow, a fault message 
will be generated. If DEL AZ is allowed to go 
out to 10.5, the small roll angles required to fly 
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low energy may not be able to bring DEL AZ 
back in. The crew should select R/Y CSS and 
initiate the first roll reversal when DEL AZ = 5°. 
AUTO flight control may be reengaged after 
completion of the first roll reversal. 


Delta State Update 


If the NAV state of the orbiter goes bad on 
entry, data from the GPS unit will be forced to 
update the orbiter state vector. MCC can uplink 
a good state vector (position and velocity). This 
is normally done by using the command uplink. 
If both GPS and the command uplink are not 
available, the delta state will be read up on the 
voice uplink, and the crew will have to enter the 
values on SPEC 50. 


The crew must also take manual control (CSS) 
before a velocity uplink is incorporated into 
the СРС$. МСС will remind the crew when to 
take CSS. 


Undesirable Transients 


Prior to any event capable of introducing an 
unwanted transient into the flight control 
system, such as a delta state update that 
includes a velocity component, the crew should 
select С55 to prevent undesirable transients. 
Automatic flight control may be reengaged 
upon completion of the event and recon- 
vergence of the guidance needles. 


Entry Control Cue Card 


The ENTRY CONTROL cue card contains three 
procedures that cover possible DAP problems 
during entry. 


ARCS ОТҮ (І + R) «1096 


The procedure applies when the total ARCS 
quantity drops below 10 percent during entry. 
With available propellant so low, steps are 
taken to conserve what propellant is left for 
those times when RCS jets are really needed to 
maintain attitude control. 


The crew takes no action until q-bar is more 
than 20 psf or if RCS jets start failing due to 
propellant depletion, whichever occurs first. At 
that time, the crew moves the ENTRY MODE 
switch on panel L2 to NO Y JET (No Yaw Jet) 
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апа select the FIXED elevon schedule оп their 
displays. NO Y JET (which becomes certified at 
q-bar = 20 psf) forces the Entry DAP to use the 
aerosurfaces rather than the yaw jets to perform 
banking maneuvers. With the FIXED elevon 
schedule, the elevons tend to deflect further into 
the airstream, becoming more effective. 


WARNING 


Selecting NO Y JET will automatically 
downmode flight control to CSS in the В/У 


axis. Crew must manually fly the vehicle, 
using the ADI error needles and other 
indicators. 


If at any point the crew experiences control 
problems, and as long as propellant remains, 
they can move the ENTRY MODE switch back 
to AUTO and use the RCS jets to try to regain 
control. Once control is re-established, the crew 
goes back to NO Y JET to again conserve 
propellant. 


SUPPLY 


г— FLASH EVAP 
м 


Г———— FEEDLINE НТА 
^ si 8 SUPPLY 
eas 


NOSE WHEEL 


ANTISKID STEERING 


ENTRY MODE Switch on Panel L2 


Below Mach 6, the aerosurfaces should have 
enough authority to adequately control the 
vehicle the rest of the way down. The crew can 
at this point take both the ENTRY MODE 
switch and the R/Y axis back to AUTO. 


Below Mach 5, the crew trims the ailerons to 
«19, This forces the rudder to pick up the trim 
load, freeing the elevons to better maneuver the 
vehicle. 
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WARNING 


Never trim the ailerons back until the 


rudder is active at Mach 5. Otherwise, RCS 
propellant is needlessly wasted in trying to 
trim the vehicle rates. 


AIL TRIM 23? 
This procedure applies when the crew notes 
that the aileron trim starts exceeding 3° during 
entry. The trim function of the Entry DAP is 
dangerously close to becoming saturated, which 
could then lead to control issues with the 
vehicle. 


The software limit for aileron trim is 3° for the 
Baseline DAP (default for TAL) and 5° for Wrap 
DAP (default EOM). So, the first thing the crew 
does is to ensure that Wrap DAP is enabled. 


If aileron trim goes on to saturate at 5°, the crew 
next raises the body flap. This causes the 
elevons to move down further into the 
airstream, becoming more effective. Then 
below Mach 13 (where changing dynamics on 
the vehicle will more than likely lead to control 
issues), the crew will manually fly alpha to as 
close to 30° as allowed by thermal constraints. 
Engineering studies show that alpha 30° is the 
most optimum angle of attack for 
controllability. If the crew is already in CSS due 
to having the ENTRY MODE switch in NO Y 
JET, they will need to limit their maneuvering 
rates, as the elevons are already having 
difficulty maintaining control 


Below Mach 5, the crew trims the ailerons to 
<1°. This forces the rudder to pick up the trim 
load, freeing the elevons to better maneuver the 
vehicle. 


Below Mach 2, the crew returns the body flap to 
AUTO for the transonic region and approach 
and land transition. 


High Freq OSC or Surf/Jet Cycle 


High frequency oscillations can be due to any 
number of reasons: bent airframe, incorrect 
bending filters, improper gains, etc. The crew 


7. TRAJECTORY MANAGEMENT 
AND FLIGHT CHARACTERISTICS 
7.3 Entry 


USA007587 
Rev. A 


may observe these oscillations on the SPI or the 
ADI rate needles. A yaw jet limit cycle may also 
occur. 


The procedure first ensures that the correct 
body bending filter is in use. The DAP includes 
bending filters in all axes that protect the DAP 
from coupling with the orbiter structure in a 
resonant oscillation. If the bending filter 
constants were wrong, oscillations can occur. 


If the condition persists, then the problem may 
be with AUTO. The crew takes CSS and 
manually flies the vehicle. 


If the condition still persists, then perhaps the 
DAP is overcontrolling the vehicle. The crew 
moves the ENTRY MODE switch to LO GAIN, 
which cuts the Entry DAP gains in half. 


If at any time the oscillations stop, the crew can 
return everything back to AUTO. If, on the 
other hand, the oscillations continue, the crew 
must continue as best they can in CSS. 


Manual Control 


WARNING 


If possible, do not downmode to CSS 
without consulting MCC. Deviations from 


the desired entry drag profile can cause 
violation of thermal limits or failure to 
reach the planned landing site. 


After closed loop guidance, the first bank 
command should be in the direction of the 
landing site (“H” pointer on the HSI). This 
maneuver is usually done in AUTO. It should 
occur at an H-dot of -240 fps. 


If CSS is required, move the RHC to about half 
deflection, watch the roll rate needle on the 
ADI, and bank at about 3 deg/sec. Prompt 
execution of the first roll command will 
minimize the bank angle required to establish 
the entry profile. 


To fly the most fuel-efficient entry, closely 
monitor the guidance needles, and always 
center the pitch needle first. Keep rates small 
and try not to start and stop the rate more often 
than necessary. Minimize the number of 
discrete КНС movements to — reduce 
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unnecessary RCS jet firings. Overly aggressive 
control during entry can cause depletion of 
available RCS propellant. The MED position of 
the ADI ERROR switch is recommended for 
entry. 


Use 6 deg/sec roll rate (full RHC deflection to 
the hard stop) to perform a roll reversal. A 
good cue to stop the roll reversal maneuver is 
H-double dot passing through zero. Returning 
the RHC to detent at this point will result in a 
smooth reduction in bank rate with final bank 
angle very close to roll command. A 6 deg/sec 
roll rate will minimize H-dot and drag excur- 
sions during the reversal. A gentle roll reversal 
at less than 6 deg/sec roll rate can require the 
use of large bank angles to recapture the 
desired drag profile. 


WARNING 


Monitor DEL AZ carefully when flying 
R/Y CSS, especially at lower velocity. 


Azimuth errors can quickly make it 
impossible to reach the desired landing 
area. 


A good instrument crosscheck of actual drag 
(Раст), reference drag (Ов), bank angle, H-dot, 
and H-double dot is required when flying a CSS 


entry. 


The following is a summary of tasks required 
during a CSS entry: 


e Fly scheduled alpha per the cue card or 
ENTRY TRAJ. 


• Bank as required to maintain H-dot ~ 
H-dot REF +20 (Раст - Окер) 


e Perform roll reversals based on DEL AZ 
(10.5° for first reversal, 17.5° for 
subsequent reversals) to Mach = 4. The 
DEL AZ limit then ramps down to 10° at 
Mach 2.8. 


No Yaw Jet/RCS Critical Entry 


The hypersonic handling characteristics of the 
orbiter are very different when in NO Y JET. The 
primary difference is the time required to start 
and stop roll rates. This difference is so great that 
the flight control system automatically 
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downmodes to R/Y CSS when МО У JET is select, 
requiring the crew to fly manually 


When in NO Y JET, the flight control system 
uses adverse yaw to start and stop a bank. The 
crew will see this by an initial roll opposite the 
commanded direction. This adverse yaw 
decreases with Mach. By Mach 5, the rudder 
becomes active and the orbiter flies much better. 
When performing roll reversals, it is important 
to use the recommended 6 deg/sec roll rate to 
minimize altitude descent rate and drag fluctua- 
tions. A gentle roll rate of less than 6 deg/sec 
may feel more comfortable, but the trajectory 
dispersions it will cause will make the ride 
uncomfortable later. 


To initiate a roll reversal in NO Y JET, the RHC 
should be moved smoothly to establish a roll rate 
of 6 deg/sec. To stop a roll reversal, a large lead 
is required to prevent overshooting the desired 
bank angle. This lead varies with Mach. The 
following is a list of typical lead angles required 
to capture the desired bank from a 6 deg/sec roll. 
The roll is stopped by centering the RHC. 


Mach Lead Angle (deg) 
>22 55 
22-7 35 
<7 15 


After the roll reversal, the roll needle should be 
kept centered. Control will be sloppy, so the 
needle cannot be kept perfectly centered. It 
takes a lot of work. It helps to try and lead the 
roll needle by monitoring H-dot and predicting 
what guidance is going to do next. For 
example, if guidance is commanding to a large 
negative H-dot, you can expect that guidance 
will command a roll out of bank in the near 
future. Developing good skills in flying manual 
entries helps in predicting what guidance will 
do next. 


NOTE 


Do not compensate for the sloppy control 
by lagging behind the needles. Adding 
lag to the system will cause large, low- 
frequency oscillations in H-dot and drag. 


The most critical region of a NO Y JET entry is 
between Mach 12 and Mach 8, where control 
margins are smallest. This is empirically 
derived from 6 degree-of-freedom simulations. 
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With the aero uncertainties present today, a 
control problem is not expected in the NO Y JET 
mode. If control problems are encountered at 
any velocity, and RCS control is still an option, 
reenable the yaw jets by returning the ENTRY 
MODE switch to AUTO. Once control is 
restored, and the orbiter is in a stable attitude, 
return to the NO Y JET mode. 


Off Nominal Trajectory Control 


Should the orbiter be outside the DPS-displayed 
nominal energy envelope, for whatever reason, 
corrections are necessary to recover. Both the 
high and low energy cases are discussed from a 
manual control point of view. 


High Energy Recovery 


If the orbiter is very high energy on entry, 
guidance will calculate a drag that is larger than 
the orbiter can withstand. This can be seen 
when the orbiter bug is to the left of the high 
energy line on the ENTRY TRAJ display. The 
high energy line is the solid line furthest to the 
left on the TRAJ display. In this case, the crew 
must take CSS and manually fly to the 
maximum drag that the orbiter can withstand. 


The details of this procedure are beyond the 
scope of the SCOM, and are taught in the Entry 
Guidance Workbook, CBT, and classes. 


WARNING 


It is very easy to overshoot maximum drag 


while flying high energy entries. It is better 
to be high energy at TAEM interface than 
to be at TAEM interface without wings. 


Low Energy Recovery 


If the orbiter bug is to the right of the low 
energy line, guidance is calculating a drag that 
is smaller than the orbiter can sustain. In this 
case, the orbiter must fly into air that is so thin 
that there is not enough lift. The low energy 
line is the farthest right line on the ENTRY 
TRAJ display. 
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If on a TAL abort, the crew should enable LOW 
ENERGY logic on the TRAJ display. Low 
energy logic automatically flies a bank angle of 
approximately 2.2 times delta azimuth. It also 
varies alpha between 42° and 25°, which 
optimizes range/crossrange capability while 
protecting orbiter thermal limitations. 
Although this software will function on an end 
of mission (EOM) return, it is not certified. 


If low energy on an EOM, the crew should take 
CSS. In pitch, fly alpha low (3° below the alpha 
arrow on the ENTRY TRAJ display), in roll fly 
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ENTRY TRAJ 2 Display 


Backup Flight System 


The backup flight system (BFS) is capable of 
performing nearly all of the primary flight 
system functions (controlled by PASS software) 
during deorbit, entry, approach, and landing. 
This section presents the major differences, 
from the flight crew viewpoint, between the two 
systems. Differences in handling qualities 
between the PASS and the BFS are very small in 
the training simulators, and no large differences 
are expected if BFS is engaged onboard the 
orbiter. A moderate control transient should be 
expected when BFS is engaged. 


Deorbit 


Automatic maneuvers are not available in BFS. 
The crew must manually fly to deorbit burn 
attitude using the error needles, MNVR EXEC 
display, and ADI attitude. The TRANS DAP 
supports both DISC RATE and PULSE modes, 
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but all three axes are switched when DISC 
RATE or PULSE is selected. 


During the burn, attitude must be maintained 
manually using the ADI error needles and REF 
ball. Upon completion of the burn, the mane- 
uver to Е1-5 attitude is a manual maneuver. 


Entry 


BFS does not support PTIs. Upon entering MM 
304, flight control mode is CSS through 
landing/rollout. 


The BFS maintains only one state vector during 
entry. Redundancy management is performed 
on most systems, but in a simpler manner than 
PASS. BFS is also set up to accept air data to 
G&C immediately upon engage. If air data has 
not been previously accepted in PASS, the crew 
should inhibit air data to G&C upon BFS engage. 


There is no digital DEL AZ output in BFS. 
However, the crew still has the HSI with its digital 
output and the “H” pointer with respect to the 
lubber line. 


Sensory Cues 


During the night portion of an entry, the 
glowing plasma sheath around the vehicle can 
be observed through the orbiter windows. The 
pulsing light has not interfered with tasks 
inside the vehicle. The plasma glow is less 
visible during daylight portions of entry and 
may not be noticeable. 


Returning from orbit, some crewmembers have 
reported increased sensitivity to g as it builds 
during entry. One crewmember observed that 
“when you hit a quarter g on entry, it seems like 
two g's in the T-38.” Crewmembers should be 
aware that their ability to perform entry tasks 
may be degraded from that experienced in the 
SMS during training. Keep in mind that Gs stay 
around 1.3 until Mach 2.5. 


Roll reversals on entry will feel different than 
pure roll maneuvers in a conventional aircraft 
due to the orbiter's entry angle of attack. Pilots 
will probably notice the yaw rate required 
during the bank change as much as the roll rate. 
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Some mission specialists have stated that they 
could barely feel the roll reversals. 


At high Mach numbers, a slight vehicle buffet 
may be noticed as well as some light structural 
vibration as dynamic pressure increases during 


entry. 
Ground Controlled Approach 


Although GCA techniques are available, they are 
emergency alternatives only. Control should be 
quickly returned to auto when conditions permit. 


During entry, trajectory is monitored via the 
Tracking and Data Relay Satellite (TDRS) and 
ground radars. Should the trajectory diverge and 
approach energy limits, a GCA will be performed. 


MCC, via the CAPCOM, will provide the crew 
with bank attitude, heading, airspeed, and 
speed brake information. 


WARNING 


On a high energy GCA, the crew should 
help monitor Gs. If the crew thinks that the 


current bank angle is leading to an over-g, 
the crew should call MCC and roll out of 


bank to not exceed Nz limit (2.0 to 2.5 g's, 
depending on orbiter weight. 


Important — H-dot leads an over g. An H-dot of 
about -300 fps will maintain about 2.0 g's. If H- 
dot is bigger (more negative) than about 
-300 fps, and Gs are headed up to the limit (~2.0 
- 2.5 g's), roll angle should be decreased. MCC 
should be notified before roll angle is 
decreased. 


GCAs are divided into three phases, based on 
energy: high velocity (Mach 10 - Mach 3), 
TAEM (Mach 3 - Mach 0.9), and final approach. 


Criteria for electing to perform a GCA depend 
upon guidance’s capability to achieve a nominal 
trajectory by Mach 5. 


In the high velocity phase, MCC provides bank 
magnitude information to control drag and 
bank direction to control crossrange. To keep 
workload under control, fly roll/yaw CSS and 
pitch, speed brake, and body flap AUTO. 
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During TAEM, a more conventional technique of 
heading to control ground track and airspeed to 
control energy is used. Fly both pitch and roll/ 
yaw in CSS. Perform turns using 30° bank angle 
unless MCC requests a steeper bank. Control 
airspeed by modulating alpha and bank angle. 


Final approach GCAs are similar to traditional 
airplane GCAs. Heading information controls 
alignment with the runway centerline, and 
position information references glide slope. 
Speed brake is used to control airspeed. 


Off-nominal energy situations could be caused 
by incorporating erroneous navigation data into 
guidance or selecting an incorrect landing site. 
If this is the case, the GCA will be used to 
control the entry profile until NAV can be 
updated via a ground uplink or a manual state 
vector update. Once the NAV state is correct, 
MCC will terminate the GCA and call for a 
return to AUTO flight control. 
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Entry Rules of Thumb 

e 2ОМ5: ТСО =АУТОТ/2. 
1 ОМ5: ТСО «ЛУТОТ. 
КС5: ТСО =1.7 х АУТОТ. 


Adjust H-dot reference 20 ft/sec for every 
1 fps? of drag error. [H-dot ~ H-dotrer + 20 
(Раст - Drer)] 


The shuttle bug superimposed on 
guidance box superimposed on nominal 
trajectory line 


Actual drag equal to reference drag 


Appropriate bank angle, H-dot, range 
and altitude 


е Attempt to contact MCC before taking CSS. 


As an approximation, 1° of bank change 


produces 0.7 ft/sec? H-double-dot change. % If you must take CSS: 


However, there is no lag in the H-double-dot 
tape. You can roll until the H-double-dot 
tape reads the desired value. 


A 3° change in alpha produces a 10 percent 
drag change. 


First bank (H-dot capture) should occur at an 
H-dot approximately -240 ft/sec. 


Monitor the trajectory on the ENTRY ALPHA 
cue card, and the PASS and BFS TRAJ 
displays: 


Control range by controlling drag. 
Control drag by controlling H-dot. 


Control H-dot by controlling H-double- 
dot. 


Control H-double-dot by controlling roll 
angle. 


Control everything slowly by small 
corrections. 
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Definition and Overview 


This section presents information required to 
pilot the orbiter from an Earth-relative velocity 
(Vrel) of 2500 fps (Mach 3.2 for RTLS), where 
terminal area energy management (TAEM) 
begins, all the way through approach, landing, 
and rollout on the runway. TAEM guidance 
provides information to the pilot and guides the 
orbiter until the transition to approach/landing 
guidance at an altitude of 5000 to 10,000 feet. 
Derotation and rollout logic take over after the 
orbiter touches down on the runway. Procedural 
information for the TAEM and 
approach/landing guidance phases аге 
contained in the Entry Checklist and cue cards. 
Pilots sometimes refer to the flight phase from 
95 Mach to touchdown as the approach and 
landing phase of flight. This is the phase of flight 
in which the crew normally controls the vehicle 
manually (CSS) and in which the Shuttle 
Training Aircraft operates. By this definition, the 
approach and landing portion of the trajectory 
includes both subsonic TAEM guidance and the 
approach/ landing guidance regions. 
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ТАЕМ апа approach/landing guidance 
trajectories allow the orbiter to handle a large 
variety of dispersions. Certain specified ground 
rules and constraints such as weight, c.g., 
aerodynamic limits, distance past runway 
threshold, velocity, altitude rates, lateral rates, 
and energy margin must be observed to ensure 
guidance is capable of directing the orbiter to a 
safe landing. Mission Control monitors these 
limits closely. Carefully following guidance 
commands (error needles) will generally 
provide the crew the best chance for coping 
with environmental dispersions. 


TAEM is divided into four phases: S-turn, 
acquisition, heading alignment, and prefinal. 
Approach and landing trajectories are divided 
into five segments: trajectory capture, outer 
glideslope (OGS), preflare and inner glideslope 
(IGS), final flare, and touchdown. TAEM and 
approach and landing regions are jointly 
designed to allow the orbiter to land safely. 
This section presents information for 
monitoring and takeover during the early 
portions of TAEM and then details the manual 
flying tasks during each segment of the 
trajectory. 


General information on handling qualities, 
flight control surfaces, priority rate limiting 
(PRL), winds, limits, BFS, sensory cues, and 
autoland is presented at the end of this section. 


Terminal Area Energy Management 


Monitoring 


TAEM guidance is initiated automatically as the 
orbiter decelerates through Vrel = 2500 fps 
(«Mach 2.5, Mach 3.2 for RTLS). This normally 
occurs at about 82,000 ft altitude and about 
60 n. mi. from the runway. The crew should note 
transition to MM 305 (MM 603 for RTLS) and 
appearance of the VERT SIT displays. Head-up 
display (HUD) symbology also appears at TAEM 
interface. TAEM guidance controls the orbiter by 
flying an altitude vs. range profile (glideslope). 
TAEM also has energy and airspeed limiting 
features (and angle of attack for RTLS). 


The outputs of TAEM guidance are functions of 
errors from these profiles. The validity of the 
output commands depends upon the accuracy of 
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NAV and air data. Guidance is only as good as 
the NAV state. 


TAEM Guidance 


TAEM guidance operates by phases. S-turn, if 
required, dissipates energy by turning away 
from the HAC until energy conditions allow a 
nominal approach. Acquisition turns the orbi- 
ter until its ground track is pointed at the HAC. 
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Heading Alignment Cone (HAC) Profile 


Heading alignment turns around the HAC until 
the orbiter is near the runway centerline. 
Prefinal transitions from the HAC to the run- 
way centerline. 


Outputs of TAEM guidance are: 
e Pitch command (М,) 
е Roll command 


• Speed brake command 


At TAEM interface, if vehicle energy is too high 
and the HAC turn angle is <200° (for OPS 3 
entries), an S-turn will be commanded. During 
the S-turn, the orbiter will fly a constant bank 
angle of 30° for end-of-mission (45° for RTLS) 
until the total energy/weight decreases to 
nominal +10,000 ft. Acquisition phase is then 
resumed, and the orbiter turns back toward the 
HAC tangency point. 


Between Mach 0.95 and 14,000 ft, the speed 
brake is controlling energy. Below 9000 ft, it is 
controlling airspeed to 300 KEAS. The logic is 
blended between 14,000 and 9000 ft. 
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NOTE 


Energy can be dissipated very rapidly. 
Ensure a high energy condition exists 
(MCC or visual) if an S-turn is triggered. 


Tracking the HAC 


Guidance uses an algorithm for roll command 
that is a function of error with respect to HAC 
radius (AR) and the rate of change of distance to 
the center of the HAC (AR-dot). The horizontal 
situation indicator (HSI) bearing pointers 
marked “H” and “C” are referenced to the HAC 
tangency point and HAC center, respectively, as 
computed by Area Nav. Wind magnitude 
affects HAC tracking. Roll angle is larger when 
flying with a tailwind and smaller with a 
headwind. On average, the HAC roll angle is 
45°. 


Prefinal 


When the orbiter is approximately 6.8 miles 
away from the runway, or below an altitude of 
7000 feet, guidance transitions to prefinal. At 
prefinal, the roll error needle may become very 
sensitive. The crew should either aggressively 
fly the roll needle or manually fly to the 
runway. Lagging the needles will only add to 
the oscillation of the roll error needles. 


If the orbiter is flying into a headwind when 
prefinal starts, the roll needle may command a 
roll to wings level. This is more likely in the 
STA, which is not usually flying as fast as the 
orbiter does at this point. This rollout is due to 
a small Y-dot, where Y-dot is the closure rate to 
the runway center line. 


At prefinal, the flight director marker changes 
from a square to a circle. It also points to the 
orbiter’s velocity vector at this time. 


Overshooting the runway centerline may cause 
the course deviation indicator (CDI) and the 
glideslope indicator (GSI) on the HSI to 
disappear momentarily. Area Nav thinks the 
orbiter wants to go around another HAC. This 
will clear itself momentarily. Although not 
required, the crew can ensure having a GSI by 
placing the HSI SELECT MODE switch on panel 
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F6 or F8 to APPROACH. This will force the GSI 
to display deviation from final approach glide 
path. 


Pitch Commands 


The output of the TAEM pitch channel is a delta 
Nz command which is sent to flight control. If 
the orbiter is down to two ААв, it is fail critical 
(i.e, one more failure will cause bad Nz 
feedback). In this case, the crew will fly pitch 
CSS and closely monitor the pitch error needles 
by cross-checking the other data. 


The crew has a great deal of data to monitor to 
make sure the pitch channel of TAEM is 
working correctly. There are five different 
sources of glideslope (altitude) information. 


Glideslope Type of Type of HAC Scaling 
data source | glideslope 
GSI on HSI Reference Spiral +5000 ft till about 
Prefinal, then +1000 ft 
Orbiter bug оп | Nominal Spiral Scale: 30K to 100K 
VERT SIT 


GSI on HUD Reference Spiral +5000 ft till 10,000 ft 
then a linear ramp 
down of scaling to 5500 
ft at 5000 ft altitude 


Vertical scale 
on PASS 
SPEC 50 


Reference Spiral +5000 ft until Prefinal, 
then +1000 її 
HORIZ SIT 
ADI pitch rate | Reference Spiral +5000 ft until Prefinal, 
pointer then +1000 ft 


Glideslope Parameters 


In addition to glideslope information, the crew 
must monitor energy and airspeed. Both 
energy and airspeed are used in the pitch 
channel. In addition to the onboard displays, 
MCC is calling "energy" based on radar 
tracking data. This data must be incorporated 
by the crew. Before HAC intercept, MCC 
measures energy and calls energy. Оп the 
HAC, MCC measures glideslope (altitude) and 
will make calls based on the following: 


e < +1000 ft altitude error - ON 


• 1000 to 2000 ft altitude error - slightly high 
or low 


e 22000 altitude error - high or low 
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NOTES 


It is essential not to confuse glideslope 
and energy. TAEM guidance does certain 
things based on energy (mainly move the 
speed brake) and certain things based on 
glideslope. There are also glideslope 
displays and energy displays. People 
often use these terms interchangeably. 


TAEM limits the supersonic roll limit to 
30° to protect the ground from a large 
sonic boom. The HAC cannot be flown at 
30°. If supersonic on the HAC, crew 
intervention is required to go over 30°. 


Large HAC Turn Angles (300°) 


Several unusual things happen with a large 
HAC turn angle. A large HAC turn angle is 
typically >~325°. 


First, TAEM guidance will command an energy 
dump, a pull-up maneuver, and a pull-up 
recovery maneuver. The crew has very little 
insight into what is happening inside of 
guidance. In general, the vehicle will pitch 
down for the energy dump, pitch up to get 
subsonic, and then pitch down to recover. The 
crew must faithfully fly the pitch error needles 
until 270° on the HAC. At this time, a normal 
instrument scan may be used. 


WARNING 


The pull-up maneuver is performed in 
TAEM by lowering maximum airspeed to 


about 200 KEAS. If TAEM does not have 
air data, it will command an uncontrollable 
pitch up at about Mach 1.3. 


Second, the crew will have very little time 
flying before HAC intercept on an entry with a 
large HAC turn angle. 


Displays 


The primary glideslope/energy displays for 
TAEM are the vertical situation displays 
(VERT SIT 1 and VERT SIT 2). The VERT SIT 
plot is scaled with altitude on the Y-axis and 
guidance determined range (range to fly) to 
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the runway on the X-axis. Three trajectory 
guidelines represent maximum airspeed, 
nominal, and maximum lift-to-drag (L/D) 
ratio. Numerical values along the lines are 
EASs that should be flown to maintain that 
reference. An orbiter symbol shows current 
altitude versus range (glideslope). Pitch 
attitude of the orbiter (bug) symbol indicates 
H-dot. Use of theta limits is discussed later in 
this section. 


The HSI is driven by Area Nav, which does 
calculations independent of shuttle guidance 
and navigation. This gives the crew a source of 
navigation processed differently from the 
onboard state vector and based only on data 
taken from GPS, TACAN or MLS (microwave 
landing system). The HSI and Area Nav are 
driven according to the HSI SELECT SOURCE 
switches on panels F6 and F8. There are three 
options available: NAV (NAV state vector to 
Area Nav), TACAN (raw (TACAN data to Area 
Nav), and MLS (raw MLS data to Area Nav). 
For 3-string GPS vehicles, the TACAN option 
above is replaced with GPS (i.e raw GPS data to 
Area Nav). An additional switch allows 
selection of the individual TACAN or MLS LRU 
(1, 2, or 3). 


qmm / VERT SIT 1 


5 000/00:31:52 
BFS 000/00:00:00 


NOSE HIT STN 


NOM 
SPD BK 66 
CMD 66 


L.018 

.000 NOSE LOT MEP 
RO.3 
RUD 10.0 


ива007587 53151 


VERT SIT 1 Display (РЕ5/ВЕ5) 
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During TAEM, the HSI "H" bearing pointer 
indicates the bearing toward the HAC tangency 
point called way point 1 (WP1), and the "C" 
bearing pointer indicates bearing to the center 
of the HAC. Range displayed on the HSI 
corresponds to range to the runway via the 
HAC (e.g., KSC15) and range to the HAC center 
(HAC-C). Range to the runway can be varied 
by changing the HAC using ITEM 6 and 7 on 
SPEC 50. Both the SPEC 50 and HSI НАС» are 
imaginary inverted cones tangent to the runway 
centerline at 12,000 ft altitude and nominally 
centered approximately 7n.mi. from the 
runway threshold. For low energy situations, 
the crew can shift the HAC to a point 
approximately 4 n. mi. from the threshold by 
executing ITEM 7. The point where the HAC is 
tangent to the runway centerline is called the 
entry point. For a nominal HAC configuration, 
the entry point is called the nominal entry point 
(NEP). Executing ITEM 7 repositions the HAC 
to a minimum entry point (МЕР), which is 
tangent to the runway centerline at 6000 ft. 


ITEM 6 allows selection of an overhead 
(OVHD) approach or а straight-in (STRT) 
approach. This allows the crew to position the 
HAC on either side of the runway centerline. 
OVHD/STRT and NEP/MEP can be combined 
to define four НАС that are available to the 
crew Юг energy management purposes. 
Guidance is always initialized to the OVHD 
NEP HAC. 
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270° HAC turn 
OVHD-> STIN saves ~ 13 n. mi. 
МЕР-» MEP saves - 3 п. mi. 


Right overhead 
Left straight-in 180° HAC turn 
OVHD-> STIN SAVES 0 п. mi. 


360° HAC turn МЕР— MEP gains 6 п. mi. 


OVHD-> ЭТИМ gains 20 п. mi. 
NEP-> MEP gains 0 п. mi. 


Left overhead 
Right straight-in 


7 n. mi 4 n. mi. 
from runway from runway 
12,000 ft alt. 6,000 ft. alt. 
887.cvs 
HAC Turns 


5K 


5K 


This part not visible on the A/E PFD 


Horizontal Situation Indicator in TAEM 
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HSI SELECT Switches on Panels F6 and F8 


NOTE 


Within 35n. mi. of the runway, switching 
between OVHD/STRT is not recom- 
mended. The heading error generated by a 
downmode could nullify any energy gains. 


The GSI on the HSI displays calculated altitude 
error computed by Area Navigation. Note that 
this is not a guidance computation. The scale is 
2500 ft per dot until Area Nav transitions to 
Approach (usually within 2.5° of Course 
Deviation), then it becomes 500 ft per dot. 
Crewmembers can force this scale change by 
selecting APPROACH on the HSI SELECT 
MODE switch on panel F6 or F8. With the HSI 
MODE switch in ENTRY, HSI mode, auto 
switching from TAEM to Approach will occur 
under the following conditions: 


e Orbiter altitude is less than 18,018 ft for 
NEP (12,000 ft for MEP), and the abso- 
lute value of the CDI is less than 2.5°. 


e Orbiter altitude is less than 12,018 ft for 
NEP (6000 ft for MEP) irrespective of 
CDI value). 


Data presented by the glideslope indicator are 
calculated assuming the orbiter will fly from its 
present position, over the proper ground track 
trajectory, to touchdown. 


The GSI shows altitude error only, not energy 
error. Similarly, on the VERT SIT displays, the 
vertical scale is altitude, not energy. 


The E/W scale (E/W = units in feet) on VERT 
SIT 1 and 2 is displayed above 20,000 ft AGL. A 
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triangle shows the calculated energy of the 
vehicle relative to the design trajectory. 
Overbright lines above and below the center 
NOM indication show 8000 ft high and 4000 ft 
low on total specific energy. If the pointer is 
between the +8000 and -4000 ft marks, TAEM is 
controlling glideslope. If out of this band, 
TAEM is controlling energy. 


These are energy status lines, not altitude. As 
with the glideslope indicator, E/W assumes a 
proper ground track will be flown. A high E/W 
bug means high energy. A high HSI glideslope 
pointer indicates low altitude on the glideslope. 


Theta limits 


scale label -4 0 E/W <@— Total energy/weight 


scale label 


Maximum pitch STN <@— S-Turn 
angle limit —» NOSE HIGH —— Current 'NAV derived' 
ma energy/weight 


*8000 ft total E/W № 
Nominal total EWE NOM <@— Nominal energy 
-4000 ft total Е/М/ label 


Pitch angle -р»- 
9 р Overhead to straight-in 


Minimum pitch energy downmode 
angle limit —> NOSE LO —— <@— NEP to MEP 
energy downmode 
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E/W Scale on VERT SIT 1 


Above the nominal energy marks is a mark 
labeled STN (S-turn). When vehicle energy, 
represented by the triangle, is above the STN 
mark, guidance may command an S-turn to 
dissipate energy. Near the bottom of the scale is 
another mark labeled MEP. Energy below this 
mark triggers an “SW TO MEP” message. An 
arrow on the bottom half of the scale marks the 
straight-in (STRT) energy level. Below this 
mark, an “OTT ST IN” message is triggered. 
The arrow disappears at 45n.mi. range, 
signifying that a downmode to STRT will 
probably produce a longer range-to-go. 


For low energy situations, it is best to try the 
STRT downmode first. This avoids a short OGS 
prior to preflare. If energy is still below the 
MEP mark, try the MEP downmode. The best 
downmoding option is a function of the HAC 
turn angle. For example, downmoding from an 
OVHD to STRT-IN within 180° has little effect. 
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Unfortunately, the energy pointer is not very 
useful in deciding if the orbiter can make the 
runway. The orbiter bug combined with 
airspeed must be used. If the orbiter bug is on 
the low line on the VERT SIT and the orbiter is 
currently flying maximum L/D, then the 
runway will barely be reached on a no-wind 
day. If the orbiter bug is on the high line on the 
VERT SIT and the orbiter is currently flying 
maximum airspeed, then the runway will barely 
be reached on a no-wind day. 


Both the high and low lines assume that no 
downmode is made. An S-turn, selecting 
straight-in, selecting MEP, or selecting a differ- 
ent runway will all have large changes to the 
range flown to the runway. 


NOTE 


Take CSS before evaluating different 
downmodes so that the displays can be 
assessed without committing a turn in the 
new direction. If the downmode is 
accepted, AUTO flight control can be 
resumed. 


In summary, crew concerns during TAEM are: 


e Remaining within critical flight control 
and structural limits (q-bar, Nz, beta, 
roll angle, angle of attack) 


e Ensuring timely and accurate data are 
input to the NAV state 


e Maintaining E/W within limits required 
to achieve A/L interface 


е Monitoring critical systems 


e Keeping pace with increasing workload 


Takeover 


In addition to the takeover conditions discussed 
in the Entry section, the crew must downmode 
to pitch CSS if air data has not been taken to 
guidance and control (G&C) prior to Mach 2.5 
(ITEM 28 on SPEC 50 HORIZ SIT). Since TAEM 
guidance tries to set up an altitude/range 
profile, a transient is possible if NAV altitude is 
incorrect prior to air data being incorporated. A 
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step change in FCS gains is also possible due to 
Mach, alpha, and q-bar errors. If air data is not 
incorporated into G&C by Mach 2, the crew 
must go CSS and fly theta limits. Flying theta 
limits is discussed later in this section. 


Manual Control 


The easiest way to fly TAEM manually is to 
precisely fly the guidance needles on the ADI. 
Each tick mark in pitch is the equivalent to a 
0.252 error, and each roll tick mark is a 5° roll 
error. Maintaining even a one tick mark error 
over an extended period of time can cause large 
errors in the trajectory. 


During the supersonic portion of TAEM, the 
pilot’s main goal is to guide the orbiter to the 
edge of the HAC on the glideslope with the 
correct amount of energy. As with the rest of 
entry, closely following guidance provides the 
best chance for coping with environmental 
dispersions—if guidance is working correctly. 
If NAV is bad (guidance is also Баа), 
TACAN/GPS data can be taken directly to the 
HSI and the Area Nav HAC can be flown 
(mentioned earlier in this section). 


With good NAV, put the “H” pointer on the 
HSI on the lubber line (the predictors will point 
at the HAC on SPEC 50). 


The most precise pitch control indicator is the 
orbiter bug on the VERT SIT. Pitch up and 
down until an H-dot that drives the orbiter bug 
back to the nominal line is achieved. Make sure 
not to fly slower than max L/D or faster than 
maximum airspeed. Max L/D is best flown by 
using max L/D alpha. L/D alpha is not a 
function of weight and roll angle and responds 
much faster than airspeed. 


The maximum airspeed of the orbiter is now 
333 KEAS. TAEM and the displays still have 
the old limit of 305 KEAS supersonic built in. 
Because of worst case air data errors, it is 
recommended not to go over 321 KEAS (actual 
indicated airspeed). 


If very low, fly maximum range alpha (max 
L/D) and change the HAC or runway selection 
if required. Back up navigation with real world 
visual cues if weather permits. 
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In extreme cases where guidance and 
navigation are bad, a GCA, along with the view 
out the windows, can be used to arrive 
overhead the field for landing. GCA 
procedures are discussed in Section 7.3. 


Manual control during the subsonic portion of 
TAEM is discussed later in this section. 


Heading Alignment Cone 


The HAC is intercepted at various altitudes, 
depending on HAC turn angle. The altitude 
varies between about 50,000 ft for a 360° HAC 
to 20,000 ft for a 90° HAC (straight in). The 
SPEC 50 HORIZ SIT horizontal scale and the 
ADI roll rate pointer provide a HAC turn 
prediction or countdown. 


A proper lead is the easiest way to keep the roll 
guidance needle centered. Leading the HAC 
turn correctly will quickly establish the orbiter 
on the HAC without calling for more than 45° 
bank nominally or up to a maximum of 60° with 
a strong tailwind. As long as NAV and 
guidance are good, closely following guidance 
on the HAC will optimize the chances of 
staying within vehicle g limitations and 
countering wind effects. 


HSI glideslope data (GSI) can also be used to 
maintain situational awareness while flying the 
HAC in order to anticipate guidance commands 
and minimize deviations from the reference 
altitude profile. 


The circle displayed on SPEC 50 is based on the 
instantaneous radius of the HAC at the orbiter's 
current position. For large HAC turn angles, 
the extended runway centerline initially will be 
projected inside, rather than tangent to, the 
SPEC 50 circle. As the orbiter continues around 
the HAC, the circle will become tangent to the 
runway extended centerline. Since the 
displayed circle is based on the instantaneous 
HAC radius, there will be a very slight 
trajectory error if the predictor dots are overlaid 
on the circle. For most situations, these errors 
are small and do not affect the usefulness of the 
SPEC 50 display. To fly precisely on the HAC 
requires that the guidance predictor dots be 
maintained slightly inside the SPEC 50 circle. 
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NOTE 


Any delay in following the guidance 
commanded roll on the HAC can result in 
going below glideslope, even if the 
guidance needles are flown perfectly after 
the delay. 


The SPEC 50 HORIZ SIT and ADI rate pointer 
scales for crosstrack error and glideslope error 
may also be used to fly the HAC. Keeping the 
reference triangle or pointer centered on the 
scales ensures flying the reference trajectory. 


HAC Options 


Profile options are included in the guidance and 
navigation system to improve low energy 
situations. The options include: 


® Straight-in approach 
® HAC shrink (spiral adjust) 
• MEP 


Selecting the straight-in approach option on 
SPEC 50 will reduce the HAC turn angle to 180° 
or less. When guidance computes the orbiter to 
be well below glideslope, a HAC shrink is 
invoked automatically by TAEM guidance. The 
HAC radius shrinks, allowing the orbiter to fly 
a shorter approach profile. The final HAC 
radius is normally 14,000 feet but the HAC can 
shrink to a final radius of 5,000 feet if necessary. 


NOTE 


A HAC shrink will occur only if the 
remaining HAC turn angle is greater than 
90° and the orbiter is on the HAC. 


The MEP option moves the HAC center point 
3 п. mi. closer to the runway. МЕР is selected 
by ITEM 7 on SPEC 50. 


Range savings using these options vary as a 
function of HAC turn angle. 


None of the options are nominal procedures. 
They are used only when the orbiter is in a low 
energy situation. 
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Default Air Data and Theta Limits 


If air data has not been incorporated to G&C by 
Mach 1.5, default air data values will be used to 
set DAP parameters. Default air data should 
ensure adequate flight control for a safe 
landing, although flying qualities might be 
degraded. 


Although default air data ensures that the flight 
control gains are set correctly, it essentially 
removes the airspeed limiting features on 
TAEM. Default air data will never tell TAEM it 
is flying too slow or too fast. 


Theta limits are a set of pitch attitude limits that 
keep the orbiter between minimum and maxi- 
mum airspeeds. Vehicle pitch attitude, as well 
as the NOSE HI and NOSE LO limits, is 
displayed on the VERT SIT display. Also, a 
theta limits bracket (green) appears on the ADI 
if ADTA is not taken to G&C or if ADTA is in 
dilemma, and Mach <2.0. The ADI theta limits 
bracket is dynamic and contracts/expands 
according to bank angle. A 50? bank angle limit 
is imposed when flying theta limits. With no air 
data to G&C, theta limits apply from 1500 fps 
(2000 fps operational constraint) until rolling 
out on final. 


NOTE 


Operationally, do not exceed 50? angle of 
bank during theta limits. Bank angles 
greater than 57? will exceed maximum 
and/or minimum theta limits. 
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ADI т ТАЕМ with Theta Limits Bracket 


WARNING 


No warning is provided when pitch up 
alpha limits are exceeded. Crewmembers 
should closely monitor theta limits and air 


speed to prevent loss of control. The pitch 
error needle will command past this limit if 
in a low energy situation or approaching a 
HAC greater than 300°. Mach 1.5 to 1.0 is 
the most critical phase. 


NOTE 


Theta limits and a tailwind combination 
can rapidly cause a low energy situation, 
requiring aggressive corrections. This is 
one of the situations where the crew will 
take the last ADTA data, if available, 
rather than fly theta limits. 


Outer Glideslope 


The OGS is an equilibrium glide path that 
provides sufficient energy at preflare for a safe 
landing. Sufficient energy includes: 


e Having enough energy to compensate 
for deceleration between preflare and 
touchdown 
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e Allowing a minimum of 5 seconds of 
stable flight time on the IGS for the pilot 
to make final corrections 


To provide sufficient energy at preflare, the 
OGS design must handle both high and low 
energy dispersions over the entire weight span 
of the orbiter. The OGS is a sloped-line segment 
that intercepts the ground at the aim point. 


л For Vehicle 
te Weights Between 
>. 180,000 & 220,000 Ibs 


Light Weight 
Outer Glide Slopes 
хү Ч, 
CC — Еш 
X-zero 
<> 
6,500' 
Close-in 
“7,500” 
Nominal aga ус 
OGS Profile 
Time to correct trajectory dispersions 15 


provided by the altitude at which the OGS is 
acquired. Nominally, this occurs at 12,000 ft. 
Transition from TAEM to A/L guidance 
normally occurs at 10,000 ft, but if the transition 
criteria have not been satisfied by 5000 ft, A/L 
transition is forced. The criteria for transition 
from TAEM to A/L get tighter as altitude 
decreases. This allows A/L equations to cycle 
through initial transients and time for the rate 
terms to reach their damping values. 


ТАЕМ ТО АРРКОАСНЛ АМО TRANSITION CRITERIA 
10,000 FT 5000 FT 
«4 DEG FLIGHT PATH ANGLE ERROR «05 DEG 


«1000 FT CROSSRANGE ERROR «100 FT 
ALTITUDE ERROR « 50 FT 


DYNAMIC PRESSURE «24  PSF 
ERROR 
(288-312 KEAS) 


«1000 FT 
«24  PSF 


(288-312 KEAS) 


TAEM to A/L Transition Criteria 


Reference velocity on the OGS is 300 KEAS for 
all vehicle weights. This velocity is required to 
compensate for the expected deceleration on the 
IGS. The design goal is to fly as fast as possible 
while remaining within maximum airspeed 
limits (333 KEAS)/q-bar (375 psf). 


А 20° OGS is used for lightweight vehicles and 
an 18? OGS for heavyweight vehicles. The 
design goal was to fly as shallow as possible 
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while maintaining sufficient speed brake reserve 
to cope with winds and trajectory dispersions. 
Since both high and low energy dispersions are 
possible, (556 were selected that resulted in a 
speed brake setting of 65 percent for midrange 
weights. One of the reasons for not forcing A/L 
guidance until 5000 ft is that ТАЕМ has direct 
q-bar control limits that will keep the orbiter on 
the front side of the L/D curve. 


Guidance and Control 


Guidance attempts to maintain the reference- 
altitude-range profile by computing a normal 
acceleration command to guide the orbiter 
along the selected OGS trajectory. Тһе Nz 
command is converted to a pitch command and 
displayed on the ADI and HUD. If the pitch 
command results in a velocity that is different 
than 300 KEAS, the speed brake responds to 
correct the velocity error. 


Leaving the speed brake in AUTO allows 
guidance to reposition it, as required, to 
maintain the reference 300 KEAS velocity. 


The body flap, if in AUTO, is commanded to 
retract to the trail position (34% on SPI) on the 
first A/L guidance pass. 


Navigation 


Upon receiving good data from the ground- 
based MLS, preland navigation is begun. 
Unlike entry NAV, preland NAV maintains 
only one state vector, but executes twice as fast 
(every 1.92 sec vs. 3.84 sec). 


The MLS provides extremely accurate azimuth, 
range, and elevation, which correct the onboard 
NAV state. Typical errors are about 5 ft 
altitude, 21 ft downtrack, and 17 ft crosstrack 
when processing MLS data. 


NOTE 


Both range and azimuth data “good” 
flags are required to process MLS data. 
Without an elevation data “good” flag, 
azimuth and range are still processed, but 
if either the azimuth or the range data 
“good” indicator is lost, all MLS process- 
ing ceases. 
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If MLS data are lost for any reason (above 1500 
ft) after processing has begun, TACAN and 
ADTA information will again become available 
to NAV until 1500 ft and 500 ft respectively. If 
MLS data are lost below 1500 ft, ADTA altitude 
processing is not possible. 


NOTE 


With TACAN data in FORCE mode, MLS 
data cannot be processed. 


Smart Speed Brake Logic 


To control orbiter touchdown energy, the speed 
brake is retracted at 3000 ft to a value calculated 
by onboard guidance that will target the 
remaining velocity profile to a fixed touchdown 
energy. The calculated speed brake position is a 
function of: 


e Wind speed 

e Vehicle weight 

e Velocity error 

e Density altitude 

e Aim point (if applicable) 

e Short field speed brake option (if 
applicable) 


This position is maintained until 500 ft where 
the A/L guidance calculates an adjustment to 
the retract angle. This adjustment is based on 
any changes in winds and predicted density 
altitude since the 3000 ft calculation. No more 
adjustments are made until touchdown. The 
500 ft adjustment altitude was selected because 
the time to fly from 3000 to 500 ft is approxi- 
mately the same time it takes to fly from 500 ft 
to touchdown. This allows time for the 
adjustment to have an effect on the vehicle 
energy state. 


When the close-in aim point is selected, 1000 ft 
are directly added to the downrange total. The 
idea is to keep the same touchdown energy 
target even though the geometry has been 
shifted in by 1000 ft. This lets the vehicle 
respond to atmospheric conditions that 
required the close-in aim point. 


Selecting the short field option on SPEC 50 
forces Autoland guidance to dissipate an 
additional 1000 ft of touchdown energy. The 
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energy dissipation is achieved by carrying an 
additional 12° to 13° of speed brake from 3000 ft 
altitude to touchdown. When this option is 
used, the pilot lands the orbiter 10 KEAS slower 
than the planned touchdown velocity and 
maintains the same nominal 2500 ft touchdown 
range. From an energy point of view, the 
additional 1000 ft of dissipated downrange can 
be converted to a velocity 10 KEAS slower than 
nominal touchdown velocity. 


The short field speed brake retract option may 
also be used on all missions if the touchdown 
ground speed is predicted to be greater than the 
flight rule limit (214 knots). Using the short 
field option for this reason will be decided by 
the flight director and will require an item 39 
entry by the crew. The goal is to provide 
additional margin from the 225 KGS certified 
tire speed limit. It is for this safety concern and 
for common training procedures that when the 
short field option is used, the crew should land 
10 knots slower rather than 1000 ft shorter. 


The short field option may be selected for 
TAL/ECAL runways to ensure an adequate 
rollout margin. In the case of heavyweight 
abort landings at runways with useable length 
of less than 11,000 ft, the CDR will target 
touchdown for 205 KEAS at 1500 ft down the 
runway. 


An additional speed brake option, selected with 
an ITEM 39 on SPEC 50, is the emergency 
landing site (ELS) speed brake. ELS speed 
brake will be selected for heavyweight landings 
on runways with a usable length of less than 
8500 ft. ELS speed brake dissipates an 
additional 1500 ft of energy over the short field 
option. For landings with ELS speed brake 
selected, the CDR targets 195 KEAS at 1000 ft. 


The maximum allowable nominal speed brake 
command at 500 ft is 50 percent, because of 
degradation of orbiter handling qualities near 
touchdown. This maximum limit is 80 percent 
when the short field, or ELS option, is selected. 


After the speed brake setting is adjusted at 
500 ft, the guidance command remains constant 
until the weight-on-wheels signal is sent to the 
GPCs. When this signal is latched, the speed 
brake is commanded to full open. 
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Visual Aids 


Aim Points 


The OGS aim point location was determined by 
energy requirements for landing and geometry 
constraints for transition between the two 
glideslopes. Distance from  preflare to 
touchdown is proportional to orbiter 
deceleration time. This distance is directly 
related to aim point location. 


The nominal aim point is located 7500 ft from 
the runway threshold. A close-in aim point is 
located 6500 ft from the runway threshold. Use 
of the close-in aim point provides an immediate 
energy increase by moving the OGS intercept 
point 1000 ft closer to the runway. 


The nominal aim point is a rectangle, whereas 
the close-in aim point is a triangle. Colors are 
chosen to contrast with the local terrain. Aim 
points on lakebeds and light-color terrain are 
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usually black. For tree- or vegetation-covered 
terrain, aim points are usually white. A dark 
background is preferred for the precision 
approach path indicator (PAPI) lights, which 
are placed on each aim point. 


PAPI Lights 


The PAPI lights define the OGS. On a nominal 
approach, the crew should see two red and two 
white lights (20° GS). For heavyweight 
landings, an 18° GS is flown (three red and one 
white PAPI. 


Three intensity settings are available for the 
PAPI lights: day, dusk, and night. 


At fixed installations such as Kennedy Space 
Center and some Edwards and Northrup 
runways, intensity is controllable from the 
tower. Portable PAPIs must be adjusted at the 
aim point. 


3,000 ft 240 ft --- Portable approach light system 
100 ft Y 
== Aim point 
6.500 ft — 4 PAPI lights, 40 ft Зи! а 
А->||4- 1101 
2 strobe lights 
240 ft  —— —»9| | |< 
100 ft 
7.500 ft = — 4 РАР! lights, 40 ft spacing 
! А (nominal айт point) 
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PAPI Light Diagram 


Techniques 


When established on the OGS, the HUD 
runway should overlay the actual runway. 
Differences indicate the amount of NAV error. 
If the overlay is good, then NAV and guidance 
should be good, and declutter level one or two 
may be selected and the guidance symbol 
followed. If excessive NAV error exists, 
declutter but do not follow guidance. The HUD 
gamma reference marks should lie next to the 
aim point if the vehicle is on the proper 
trajectory. 


Without a HUD, use the ADI error needles as 
long as the NAV state is good. With MLS data, 
the NAV state will generally be very good. Use 
of TACAN only will produce errors requiring 
the pilot to fly the OGS primarily using the 
HUD and external references. 


Since the PAPI lights 
instantaneous GS status, they must be 
continuously monitored for trends. If the 
onboard NAV state is reasonably good, and the 
crew tracked guidance around the HAC, energy 
should be close to nominal, and the HUD 
velocity vector should be positioned near the 
aim point after rolling wings level on final. If 
the PAPI lights are not operational, use the 
rectangle on the ground at the nominal aim 
point (or the triangle at the close aim point), and 


only show an 
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align the gamma reference marks оп the HUD 
with the appropriate aim point on the ground. 


Night approaches should Бе considered 
instrument approaches. Due to lack of outside 
references, bank control is more difficult. Sink 
rate is not apparent until after preflare. 


The speed brake is left in AUTO mode for the 
approach. This allows automatic guidance to 
command the speed brake to control airspeed 
on the OGS to 300 KEAS. There are failure 
modes that may fail the speed brake in any 
position from full open to full closed. 


With speed brake stuck closed, lowering the 
landing gear early results in equivalent drag of 
60 percent speed brake. 


Stuck open speed brake can be compensated for 
by flying a steeper OGS with an adjusted aim 
point closer to the runway. 


If a higher than nominal altitude condition 
exists at rollout (GSI full deflection), the CDR 
must make an immediate and aggressive 
pushover to reacquire the proper flightpath to 
ensure the transition to A/L occurs as early as 
possible. 


If the BFS is engaged, it is even more imperative 
that the CDR make an early attempt to correct 
to the proper glidepath, since the BFS has no 
A/L guidance mode. 
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CAUTION 


When rolling onto the OGS with excess 
altitude, TAEM prefinal guidance gains 
may not be aggressive enough to command 
the orbiter back into the A/L envelope. If 
guidance is followed, the resulting flight- 
path will parallel the reference OGS with 
the aim point displaced down the runway. 
When A/L is forced (not later than 5000 ft 
AGL), guidance will give aggressive pitch 
commands to try to reacquire the OGS. If 
followed, these commands could result in 
an excessive dive angle requiring as much 
as a 2.0 g pullout for the preflare maneuver. 
This can be avoided if the CDR closely 
monitors the HSI GSI while flying the HAC 
and bearing in mind that the ADI pitch 
steering needle provides a much more 
noticeable indication of Nz command than 
the HUD. 


Preflare 


The preflare maneuver is used to transition 
from the OGS to the IGS. Flight path geometry 
is a sector of a circle tangent to the OGS and an 
exponential to the IGS. H-dot of about 190 fps 
must be reduced to less than 3 fps at touch- 
down. Preflare reduces H-dot to about 12 fps, 
with the remainder taken out in final flare. 
Pullup is about 1.35 g. 


Note: Not drawn to scale 
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Since the speed brake is retracted at 3000 ft and 
preflare nominally occurs at 2000 ft, the 
orbiter’s velocity will increase about 10 KEAS. 
As flight path angle nears the minimum steady 
state value (-12°), velocity will begin to 
decrease. 


Techniques 


There is a strong tendency, especially with 
inexperienced pilots, to be too aggressive in the 
preflare or to anticipate the maneuver, ending 
up high and slow. This tendency is aggravated 
at night, when closure rate and depth 
perception cues are reduced. 


CAUTION 


The preflare is a gentle maneuver. Early 


and/or aggressive preflare may result in a 
high and slow inner glideslope from which 
a hard landing can occur. 


Utilizing the HUD flare markers will generally 
result in good preflare maneuvers. Approach- 
ing 1000 ft to 800 ft, use the ball bar to intercept 
the IGS at about 300 ft. Without a HUD, the ball 
bar is the best reference during preflare. 


For some low energy cases, delaying preflare to 
as late as 1000 ft may help to correct the 
situation. Perform a flare maneuver that results 
in a landing with a very minimal amount of 
IGS. Stuck open speed brake (greater than 60 
percent) will require a more aggressive preflare 
with very little time on the IGS. 


CAUTION 


Failure to anticipate the rapid airspeed 
with stuck open 


decay during preflare 
speed brake (more than 60 percent) may 
result in high sink rate landings. 


Use crab angle to control drift due to crosswind 
during the preflare. A significant change in 
crab angle during preflare should be expected 
due to the large change in airspeed and altitude 
during the maneuver. 


74-14 


Inner Glideslope 


Transition to the IGS begins at 300 ft. Once the 
landing gear is deployed, and the orbiter is on 
the IGS, deceleration is fairly constant at 4 
KEAS per sec. Each additional second the 
orbiter remains airborne results in a 4 knot 
slower touchdown velocity. The 1.5? IGS was 
designed to give the pilot at least 5 sec of stable 
flight before final flare. 


Once stabilized on the inner glideslope, since 
the orbiter is decelerating, some pitch attitude 
changes will be required to maintain the desired 
trajectory. 


Landing Gear 


The landing gear creates a great deal of aero 
dynamic drag, which can significantly alter 
touchdown energy. Тһе landing gear is 
deployed on an altitude cue by the pilot who is 
not flying the approach. Current flight pro- 
cedures are to arm the gear at preflare (2000 ft) 
and lower the gear at 300 + 100 ft. The design 
requirement is to have the gear down and 
locked at least 5 sec before touchdown. Gear 
deploy should not be delayed below 200 ft. A 
100 ft difference in gear deploy altitude equals 
about 250 ft of touchdown energy. A nominal 
300 ft deploy is assumed in landing energy 
predictions. 


Final Flare 


The final flare maneuver reduces H-dot on the 
IGS to an acceptable value at touchdown. Final 
flare should be a smooth increase in pitch 
attitude started at an altitude high enough to 
result in a timely decrease in H-dot before 
touchdown. Strive to touch down 2000-3000 
feet down the runway at a safe rate of descent. 
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Shoot for an airspeed within +5 to -10 knots of 
the target airspeed. 


Maximum H-dot at touchdown was designed to 
protect the main gear struts from unacceptable 
loadings. Each strut can withstand up to 
207,000 Ib, although the actual H-dot limit varies 
from 6 to 9 fps as a function of vehicle weight 
and crosswind. 


A very important factor in reducing H-dot is the 
powerful aerodynamic ground effect of the 
orbiter. This effect grows as altitude decreases, 
increasing L/D by about 25 percent. Minimize 
RHC inputs prior to touchdown, and expect 
ground effect to cushion sink rate. 


The 1.5° IGS used by guidance is a compromise. 
It does not require a large maneuver to land, yet 
maintains a reasonable ground clearance when 
coming out of preflare. 


Techniques 


A negative handling quality of the orbiter is that 
initial vehicle response to pitch control inputs is 
backwards from the desired performance. This 
is due to relative locations of the c.g. 
aerodynamic center, control surfaces, and the 
pilot’s seat. For example, a pitchup command 
from the RHC causes an upward elevon 
deflection. The up elevon initially causes a 
decrease in lift (approximately 2000 Ib рег 
degree), and the wheels actually move closer to 
the ground at a faster rate. Тһе expected 
positive lift increment will not occur until the 
orbiter has rotated to a higher angle of attack. 


CAUTION 
Attempting to reduce H-dot may actually 


increase the rate, and, if timed incorrectly, 
can result in an early touchdown. 
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Ball Bar Geometry 


Pilot eye height just prior to landing is nearly 
constant. Therefore, out-the-window cues are 
poor indicators of actual H or H-dot after 
control inputs. 


The HUD should be used to monitor pitch 
attitude and make precise adjustments both on 
the IGS and for final flare. For no-HUD 
approaches, use the far end of the runway or 
the horizon, since pitch attitude changes are 
very difficult to see due to a lack of references. 


А “bang-bang” technique of pitch attitude 
corrections on the IGS has proven to be effective 
for some pilots. Small pitch inputs are made, 
and the RHC is quickly returned to detent. 
After each input (or series of inputs for larger 
corrections), wait until the effect is apparent 
before making another correction. This 
technique is less effective as landing weight 
increases and c.g. moves forward. 


Ball Bar 


The ball bar defines a 1.5? GS. Overlaying the 
center of the ball across the center of the bar 
results in a threshold crossing height of 26 ft. 
Normal guidance profile changes due to winds 
will result in some difference in threshold 
crossing heights. Try to shoot for 20-30 feet 
threshold crossing height during training. 


Touchdown rectangles on the runway surface 
may also be used. The leading edges of the 
marks are 2500 ft from the threshold, and the 
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marks are 200 ft long and 40 ft wide. Aiming 
the orbiter straight toward the marks from ball 
bar intercept until final flare results in good IGS 
control and safe threshold crossing heights. 
This technique is especially helpful for no-HUD 
approaches. 


For the final flare, matching digital altitude and 
digital airspeed on the НОО (40,240... 30, 230 
. . . 20, 220) will result in a smooth maneuver 
from the IGS to touchdown. 


Touchdown 


A/L trajectory was designed to result in 
touchdowns about 2500 ft past the runway 
threshold at a safe speed and sink rate. 


Ihe same touchdown speeds are usually 
targeted by the pilot when flying CSS to 
provide a more consistent energy reserve and 
orbiter pitch attitude at touchdown. Energy 
reserve is the time (in sec) that the orbiter could 
have flown until pitch attitude reached 
tailscrape angle (15°). Energy reserve varies 
with weight, since heavier vehicles must fly 
faster than lighter vehicles in order to produce 
aerodynamic lift equal to weight. Consistent 
energy reserve and consistent pitch attitude are 
very important factors that help pilots land with 
sink rates within vehicle limits. With nominal 
speed brake selected target touchdown speed is 
195 KEAS for weights less than or equal to 
222,000 15 and 205 KEAS for weights greater 
than 222,000 Ib. 
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T/D velocity by vehicle weight 
(KEAS) 


(ft) <200K | 200K-222K | >222K | >245K 
2500 | 195" 195 


Short field - for tire speed margin 2500 


205 


205 Ф 
1500 ft 


185 185 195 


205 


Short field - for runway length 1500 | 195 195 


ELS 


* 185 KEAS is acceptable for certain touchdown energy cases. 


1000 195 _ 195 


Touchdown Targets 


Energy Reserve/Tailscrape 


Starting with STS-50, the speed brake (in 
AUTO) targets 2500 ft at 195 KEAS touchdown 
energy for lightweight vehicles and 205 KEAS 
for heavyweight vehicles. A rough rule of 
thumb is 90 ft of touchdown distance 
corresponds to 1 knot of airspeed. 


VTailscrape - VTouchdown 
Decelerationayg 


ENERGY RESERVE = 


15 deg 
(for the body flap 
in trai 


TAILSCRAPE — The maximum pitch attitude (deg) the 
vehicle can land at and not scrape the tail (body flap). 


ENERGY RESERVE — The time (sec) the vehicle 
could have continued flying after touchdown until the 


tailscrape condition. 
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The most significant factors 


touchdown energy are: 


e Winds 


influencing 


* Density altitude 
e Vehicle weight 
e Velocity error at 3000 ft 


Off-nominal factors such as landing gear deploy 
altitude, GNC air data errors, tile damage, stuck 
speed brake, and NAV errors may also be 
significant. 
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Variations in touchdown energy of +500 feet 
due to the factors listed above are not unusual. 
Pilots should strive to touch down 2000-3000 
feet down the runway at a safe rate of descent 
within +5/-10 knots of the target airspeed, 
allowing touchdown airspeed to vary slightly 
with touchdown energy dispersions. Minimal 
RHC activity prior to touchdown is desired to 
preclude pilot induced oscillations. 


For crosswind landings, use crab angle to 
control drift. Maintain the required crab angle 
all the way to touchdown. 


Weight on Wheels Discretes and Flight 
Control Moding 


At touchdown, the weight on wheels (WOW) 
discrete must be set to properly mode flight 
control for derotation and rollout. WOW is 
automatically set by the combination of wheel 
speed sensors and squat switches (weight on 
wheels sensors) in the main landing gear struts. 
Weight on nose gear (WONG) discretes are set 
by the squat switches in the nose gear. The 
crew сап set the WOW/WON(QG discretes 
manually by selecting the SRB or ET 
SEPARATION MAN mode and depressing the 
appropriate pushbutton. Procedurally the SRB 
Sep switch is favored over the ET Sep switch 
because the SRB Sep switch is a single toggle 
switch and the ET Sep switch is an over-center 
lever lock switch. This makes the SRB Sep 
switch easier and quicker to operate. 
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MAN/ AUTO MAN 
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О 9 BAND 
AUDIO | [— 01 PCMMU ———4 
CENTER PWR FORMAT CONTROL 
1 1 GPC CMD 


SRB SEPARATION and ET SEPARATION 
Switches and Pushbuttons on Panel C3 


CAUTION 


Failure to set the WOW/WONG discrete 
allows the DAP to remain in A/L mode. 
Flight control gains are not optimized for 
derotation and rollout and may cause 
control problems. Braking and nose wheel 
steering will not be available. 


Crews are trained to routinely set WOW/ 
WONG manually at nose gear touchdown to 
protect for a WOW and/or WONG discrete 
failure. 


WARNING 


Do not attempt to set WOW/WONG 
manually prior to nose gear touchdown. If 
set in the air and pitch attitude is less than 
0°, as on the OGS, the WOW/ WONG flags 
are set true, including elevon load relief. 
Elevon load relief drives the elevons to the 
10° down position, causing an abrupt pitch 
down maneuver. Additionally the pitch 


axis modes to AUTO and the RHC pitch 
CSS downmode angle opens to 21.7°. This 
requires full aft RHC to mode back to CSS 
and recover from the pitch down. If a 
manual SEP pushbutton is depressed at 
main gear touchdown, the rollout discrete 
will be set when pitch attitude decreases 


below 0°. Elevon load relief would cause 
excessive rates on the nose gear strut at 
slapdown. 
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Once the WOW discrete is set, the speed brake 
opens to 100 percent to help slow down the 
vehicle. The WOW discrete also sets flat turn 
and HUD discretes, which cause mode changes 
in the aerojet DAP. In the roll/yaw channel, 
when WOW is set, rudder trim and aileron trim 
freeze, and auto load balancing becomes active. 
Auto load balancing uses aileron commands 
generated through the roll channel to balance 
loads on the main tires. These commands are 
computed as a function of true airspeed, lateral 
acceleration, and vehicle yaw rate. Also at main 
gear touchdown, lateral acceleration feedback 
and rudder trim loops are opened. In CSS, 
pitch axis information drives only the ADI error 
needles. Brake isolation valves are opened 
allowing the main wheel brakes to operate. 
Operationally, braking is delayed until after 
WONG, past midfield, and less than 140 KGS. 


Derotation 


There are two phases of the derotation portion 
of orbiter landings, attitude hold and the 
derotation maneuver itself. Both are important 
and are discussed separately for clarity. 


Attitude Hold 


This phase is designed to reduce maximum 
loads on the main landing gear. Pitch attitude 
is held constant until EAS decreases to 185 
KEAS, when beep trim is used to perform the 
derotation. This speed was selected as a 
compromise between maximum load on the 
main gear, maximum load on the nose gear, 
time between touchdown and start of 
derotation, and the need to have the nose gear 
on the runway surface in time to start braking. 


Derotation Maneuver 


Derotation is accomplished by the CDR pushing 
the RHC trim switch (the beep trim switch) 
forward at 185 KEAS. The beep trim switch 
ramps up to a commanded 1.5 deg/sec rate and 
gives a smooth derotation. The manual backup 
derotation maneuver will be used if beep trim is 
inoperable or inhibited. The recommended 
pitch rate in CSS is 1 to 2deg/sec. Input the 
derotation command smoothly over a period of 
1 to 2 seconds. 
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Derotation must Бе commenced at the proper 
speed and the pitch rate maintained throughout 
the maneuver. Attempts to significantly slow or 
stop the pitchdown rate can cause dangerous 
pilot-induced oscillation (PIO). 


Executing a manual derotation requires good 
crew coordination and must be practiced in the 
simulator. The pilot not flying the approach 
and landing should call out airspeeds, with a 
“derotate” statement at 185 KEAS. A positive 
nosedown command must be input and held 
with the RHC to generate the desired 1 to 
2deg/sec pitch rate. When pitch rate is 
established, callouts of “down at 1, down at 
1-1/2, . . ." are very helpful in maintaining a 
constant rate until nose gear touchdown. The 
pitch rate needle on the ADI is the best source 
of this information. The onset rate of the 
derotation rate command is critical for 
minimizing main gear loading during and after 
derotation. Too quick an onset can result in 
main gear oscillations and load spikes that go 
over the max limit. Too slow an onset can result 
in high nose gear loads. Heavy gross weight 
landings on lakebeds (high rolling friction 
coefficient) are the most difficult to control. 


CAUTION 


Derotation is a critical maneuver. Do not 
delay derotation, especially on lakebeds at 
heavy gross weight. Loss of elevon 


effectiveness can cause hard nose gear 
slapdowns and possible structural damage. 


Derotation must also be initiated at the 
proper rate. If the derotation command is 
input too quickly, main gear loads may be 
exceeded at high landing weights due to 
strut oscillations. If the derotation is input 
too slowly or at the wrong rate, nose gear 
limit loads may be exceeded. 


Rollout 


Two phases of rollout are coast and braking. 
Rollout margin and brake energy limits are 
defined to ensure the orbiter can stop prior to 
the end of the runway. Generally, high-energy 
rollout margin is considered to be 2000 ft and is 
measured either from the end of the runway or 
the end of the usable overrun. Brake energy is 
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limited to 42 M ft-lb for end of mission 
landings. If predicted brake energy exceeds 
these values, runway redesignation will be 
considered. 


Note that crosswinds directly increase resulting 
brake energy when differential braking is used 
for lateral control during rollout. 


Short field speed brake may be selected on 
SPEC 50 to achieve required rollout margin or 
brake energy limits. This software logic adjusts 
the speed brake retract function to target a 
touchdown velocity 10 KEAS slower at 2500 ft 
past the threshold for all weights. 


Coast 


Coast phase begins when the weight on nose 
gear (WONG) signal is set. Elevons are moved 
automatically from the position required to 
control derotation to 10° down in order to 
reduce loads on the main landing gear. The 
crew should monitor auto load relief on the SPI. 
If it does not occur, WOW/WONG should be 
set manually with the SRB Sep switch and 
pushbutton. WONG also sets the RHC to half 
the original gains. 


WARNING 


Failure to perform load relief can cause 


unacceptably high loads on the main gear, 
resulting in potential tire failures and loss 
of control. 


Deceleration on the runway during coast is 
about the same 4 KEAS per sec as on the IGS. 


Nose Wheel Steering 


HUD rollout discrete and groundspeed enable 
are nominally set at nose gear touchdown. 
Nose wheel steering (NWS) is available once 
ground speed enable is set. Steering may be 
accomplished with differential braking, rudder 
inputs (above 100 KGS), or NWS. Two modes 
of NWS are available: 


1. NWS 10): Rudder pedal deflections 
incorporated as biases to N, feedback. 
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2. OFF: No steering commands; nose 
wheels caster. 


Braking 


The start of braking is normally determined by 
groundspeed, although distance remaining on 
the runway is also considered. Braking begins 
when groundspeed is less than 140 KGS and the 
orbiter has passed the midfield point, or if 
distance remaining is less than 5000 ft. 
Deceleration rate of 8 to 10 fps? should be 
maintained until below 40 KGS where the rate 
is decreased to about 6 fps. Maximum braking 
is applied if distance remaining is less than 5000 
ft at more than 140 KGS. 


Barrier 


The barrier net system has been removed from 
all runways. 


Techniques 


NWS should be used for directional control and 
brakes used for stopping unless differential 
braking is required. NWS operations in NWS 
1(2) are crisp and responsive with no tendency 
to overshoot or overcontrol. 


The NOSE WHEEL STEERING switch on panel 
L2 has an extension device mounted on the 
shaft to make it easier to locate. 


If NWS 1 fails during rollout, NWS 2 may be 
selected, however it is susceptible to the same 
failure and become inoperative. 


With NWS in NWS 1 (2) , the orbiter will tend to 
turn into a crosswind during rollout. With 
NWS in caster (OFF), the orbiter will tend to 
turn away from а crosswind. 


If a tire failure occurs during rollout, the orbiter 
will turn toward the failed tire. When the 
turning moments due to crosswind and tire 
failure are in the same direction, large control 
inputs will be required to maintain runway 
centerline. When the turning moments are in 
opposite directions, smaller control inputs will 
be required, and pilots must be careful not to 
overcontrol. 
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Rollout performance is best demonstrated in the 
vertical motion simulator (VMS) at NASA Ames 
Research Center. NWS and tire failures are 
realistically modeled, allowing crewmembers to 
experience actual orbiter dynamics while 
making corrections. Crew coordination and 
skills are practiced in the Shuttle Mission 
Simulator (SMS). Crewmembers should ensure 
that different rolling friction coefficients and 
wind conditions are seen, as well as appropriate 
system failures that disable or downgrade the 
NWS system. 


Handling Qualities 


Тһе space shuttle DAP is a rate command 
system. When the RHC is moved from detent, 
aerosurfaces are deflected to command a bank 
or pitch rate. Due to control requirements 
during high speed flight, the aerosurfaces are 
very large and can generate large rates, even 
with a heavyweight vehicle. Smooth control 
inputs will minimize transients and the initial 
tendency to overcontrol. 
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Control harmony is excellent in all axes, with 
crisp response апа essentially deadband 
damping. Returning the RHC to detent reduces 
vehicle rates to zero (plus or minus rate 
deadbands). Control surfaces remain active and 
will attempt to maintain attitude. 
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The shuttle training aircraft (STA) is ап 
extremely accurate simulator of orbiter flying 
qualities below 35,000 ft altitude. Training for 
high and low energy cases in the STA will 
prepare crewmembers to handle the actual 
vehicle from about the 180° point on the HAC. 
The STA also has the capability to demonstrate 
navigation state errors up to 6500 ft short, 2000 
ft long, and 1,200 ft laterally from the desired 
touchdown point. 


Elevons 


During subsonic flight, all four elevons are 
commanded up and down simultaneously for 
pitch control. For roll control, the elevons are 
commanded differentially, similar to ailerons on 
a conventional aircraft. 


Body Flap 


The body flap is used to trim the elevons during 
entry and TAEM. When guidance transitions to 
the A/L phase, the body flap is commanded to 
trail. Normally, the body flap is operated in 
AUTO. If the body flap is not in AUTO, the 
crew should return to AUTO or manually 
position the body flap to trail at A/L transition. 


CAUTION 


The body flap is a large control surface and 


exerts a powerful pitching moment on the 
vehicle. Proper positioning is required to 
ensure adequate control margins. 


Speed Brake 


Although energy is controlled primarily by 
bank angle and the resulting drag in hypersonic 
and supersonic flight, the speed brake is the 
primary energy control device іп subsonic 
flight. A/L guidance modulates the speed 
brake to control airspeed, when operated in 
AUTO. Speed brake position is constrained to a 
lower limit of 15° to prevent physical binding of 
mechanical linkages when the rudder is 
deflected. 


Manual control of the speed brake may be taken 
if guidance or NAV is questionable. For 
example, erroneous air data could cause flight 
control to generate erroneous position 
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commands, resulting in high or low energy or a 
flight control transient at a critical moment. At 
3000 ft AGL, the speed brake is retracted 
automatically to a computed value based on 
wind, weight, density altitude, velocity error, 
aim point, and short field option. At 500 ft 
AGL, guidance can command а final 
adjustment of the speed brake position based on 
density altitude and wind velocity. 
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Surface Position Indicator 


The speed brake is normally operated in AUTO 
throughout approach and landing. Speed brake 
position and command are displayed on the SPI 
and the HUD. 


WARNING 


The speed brake is a very powerful drag 
device. Overlooking a stuck speed brake or 


neglecting to retract the speed brake when 


operating in MAN сап result in 


dangerously low energy. 


Rudder 


Corrected body roll rate is used in the DAP yaw 
channel as a yawing rate error to generate 
rudder commands. This essentially provides 
turn coordination. Rudder pedal deflection 
serves only to bias the N, feedback. Since 
rudder deflection is largely a function of the 
automatic stability loops, crewmember rudder 
pedal input should not be required prior to 
touchdown. 
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Trim 


Automatic trim loops in the shuttle flight 
control system work very well, and although 
manual capability is available, it is not usually 
required in the approach and landing flight 
phase. One exception is after a BFS engage. In 
this case, the trim values initialize at zero, and 
the pilot can help the flight control system 
return to a trimmed condition more quickly by 
trimming manually. 


Priority Rate Limiting 


All aerosurfaces (except the body flap) are rate 
command limited by priority rate limiting (PRL) 
software. This allows full advantage of 
available hydraulic system power while not 
overloading the hydraulic systems. Rate 
command limits vary as a function of the 
number of hydraulic systems available. 
Simulations have shown that vehicle control is 
adequate with reduced rate limits, but pilots 
should be aware that control could Бе 
degraded in aggressive maneuvers. Beep trim 


derotation will be used to prevent elevon 
saturation and high nose gear slapdown loads. 


HYD SPEED 
SYS | ELEVONS | AILERONS BRAKE RUDDER 


5.47 (OP), 6.06 (CL) 
6.1 (OP), 10.86 (CL) 
6.1 (OP), 10.86 (CL) 


PRL Rate Limits in Degrees per Second 


Automatic PRL normally requires little crew 
interaction. Hydraulic pressure from all three 
sensors in each system is sent to the GPCs via 
flight ай (FA) multiplexer/demultiplexers 
(MDMs). A hydraulic subsystem operating 
program (HYD SOP) provides redundancy 
management (RM) for fault detection and 
isolation of failed transducers. A selection filter 
generates one pressure from each system. 


HYD SOP declares a hydraulic system failed if 
the selected system pressure drops below 
1760 psi. Fail flags are provided to PRL 
software, which then rate-limits aerosurface 
commands based on number of good systems. 
PRL status and management are on SPEC 51. 
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Using item numbers, the crew can place PRL in 
automatic systems management, deselect a 
system, or invoke manual systems 
management. A failed system is indicated by a 
down arrow in the system status column. 
Failed systems are not used by PRL. Loss of 
hydraulic pressure information can cause a PRL 
dilemma and a question mark (?) is displayed 
next to the affected system. When a dilemma is 
declared, PRL leaves the system status as it was 
prior to the dilemma. The crew can then either 
manually deselect or reselect the system after 
determining its real status using other cues. 
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Wind Effects on Trajectory 


Winds affect the orbiter's capability to fly the 
desired HAC trajectory and can result in high or 
low energy situations if not handled correctly. 
Since the onboard navigation and guidance 
systems cannot predict winds, the crew must be 
prepared to anticipate high wind conditions 
and compensate for them. Information on wind 
speed and direction is passed to the crew prior 
to the deorbit burn. This information is 
updated as required during entry. Data are 
provided for the following altitudes: 
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НАС 
ALTITUDE | POSITION 


Wind Data Table 


The current speed brake energy-control logic in 
TAEM guidance compensates for wind 
conditions prior to and on the HAC to maintain a 
nominal energy profile. Manual flying 
techniques should not be required to counter 
wind conditions. Normal piloting techniques, 
flying the guidance needles, should be sufficient. 


Wind data is obtained by the Flight Dynamics 
Officer (FDO) in the MCC from the NASA 
meteorologists. Wind data is forecast based on 
balloon data and later compared to winds 
observed by the STA weather aircraft. Since the 
wind conditions that can cause low energy have 
much more serious consequences, they are 
discussed in more detail here. 


Constant Headwind 


For a given reference airspeed, any headwind 
greater than zero will result in less kinetic 
energy (less ground speed) than the no wind or 
tailwind case. 


Sudden Headwind Increase 


For a given initial energy state, a headwind 
shear will cause more drag and greater energy 
loss, until the pilot compensates for the 
immediate drag increase. 


Tailwind Below 50 Feet 


Tailwinds, or reduction in headwinds, are 
normally favorable in a glider because of the 
reduction of drag. However, at less than about 
50ft, the beneficial effects of drag reduction, 
integrated over such a short period of time, are 
outweighed by the sudden loss of available 
energy caused by the instantaneous decrease in 


7.4-23 


USA007587 
Rev. A 


KEAS. Large sink rates and hard landings may 
result. 


Crosswinds 


Use crab angle to control lateral drift due to 
crosswind from outer glideslope intercept until 
touchdown. Expect a noticeable change in crab 
angle during preflare and on the inner 
glideslope due to the large changes in velocity 
and the change in wind speed as altitude 
decreases. 


Post touchdown, align the fuselage with the 
runway to reduce nose gear side loads at nose 
gear touchdown. During rollout, the orbiter 
will tend to turn into a crosswind with NWS in 
NWS 1(2). With NWS inactive, the orbiter will 
tend to turn away from a crosswind. 


Limits 


Headwind, tailwind, and crosswind limits are 
listed in the Flight Rules and summarized in the 
Limits section of this manual. These limits are 
conservative and are based on simulator, wind 
tunnel, and actual flight data. End of mission 
runways are selected so that all parameters are 
within limits. 


Backup Flight System 


The BFS is capable of performing nearly all of 
the primary flight system functions during 
TAEM, approach, and landing. This section 
presents the major differences, from the flight 
crew viewpoint, between the two systems. 
Differences in handling qualities between the 
PASS and the BFS are very small in the training 
simulators, and no large differences are 
expected if BFS is engaged onboard the orbiter. 
A moderate control transient should Бе 
expected when BFS is engaged. 


The BFS does not support PTIs. Flight control 
mode is CSS from engage through landing 
rollout. 


The BFS maintains only one state vector during 
entry. Redundancy management is performed 
on most systems, but in a simpler manner than 
PASS. ВЕС is also set up to accept air data to 
G&C immediately upon engage. If air data has 
not been previously accepted in PFS, the crew 
should inhibit air data to G&C after BFS engage. 
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MLS is not supported. Guidance terminates in 
BFS at 2000 ft, ADI error needles are stowed, and 
the speed brake is commanded closed at 2000 ft. 
On a BFS approach to landing, the crew must 
manually set the speed brake to the DEL PAD 
setting at 3000 ft and then open the speed brake 
to 100% at main gear touchdown. 


Off-Nominal Approaches 


This section briefly summarizes the procedures 
used to correct problems typically encountered 
during training. More detailed information is 
available in the Approach and Landing Flight 
Procedures Handbook. 


Navigation Errors 


A bad navigation state can put the orbiter in a 
high or low energy condition. If the error is 
detected early in entry or TAEM, Mission Control 
will declare a GCA and provide guidance to the 
landing site until the navigation state can be 
corrected with GPS, a state vector uplink, or 
manual state vector update. If errors are 
observed after the field is in sight, pilots can use 
visual cues in addition to MCC calls to fly to the 
runway. 


Known Tire Fail / Leak 


Landing with a known flat or leaking main gear 
tire requires special landing techniques to try to 
save the remaining tire on the strut. Landing on 
a concrete runway (KSC or EDW) is preferred 
over lakebed runways due to better vehicle 
handling qualities on the concrete in the event of 
both tires failing on the same strut. Approach to 
the runway should be made with the crosswind, 
if any, coming from the same side as the failed 
tire. At touchdown this reduces the load on the 
remaining good tire due to the vehicle tendency 
to roll away from the crosswind. 
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At main gear touchdown the crew should mode | 
the pitch axis to AUTO. This will allow an 
automatic derotation to begin at 180 KEAS. The 
drag chute should be deployed at 185 KEAS to 
coordinate the timing of chute disreef and max 
gear load during derotation. 


At nose gear touchdown the CDR should 
command a maximum roll, with the RHC, away 
from the failed tire. This causes the elevons on 
the wing with the failed tire to move down as 
much as possible, further relieving the load on 
the remaining good tire on that strut. 


During rollout, the crew should be prepared to 
use NWS and differential braking, on the good 
wheels, for directional control. 


FAILED TIRE TECHNIQUE 
Pos-MGTD  Р-АОТО 
185 KEAS Deploy drag chute 
180 KEAS YAuto derotation 
NGID Max RHC roll away 
from failed tire 
Single APU Landing 


Ну a nominal approach. At 3000 ft manually set 
the speed brake to the DELPAD setting. Do not 
adjust the speed brake at 500 ft. Do not open the 
speed brake at main gear touchdown. This 
prevents the speed brake from taking hydaulic 
flow from the elevons during high hydraulic 
flow demand flight activites - gear deploy, 
touchdown, derotation. 
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Stuck Speed Brake 


Procedures for stuck speed brake approaches 
vary with speed brake setting and are summa- 
rized in the following table. These procedures 
depend on detection of the stuck speed brake 
prior to the HAC, where energy can be adjusted 
more easily without using the speed brake. The 
Stuck Speed Brake procedure is not a published crew 
procedure and, as such, is not found in the Flight 
Data File (FDF). This is an on-console procedure for 
the Guidance Procedures Officer (GPO) in the event 
it is needed. 


SB Setting Selected 
(stuck) TAEM AIL Aimpoint 
270! M «0.95 — 1 dot Hi on 3000 ft 
GSI (use pitch) 
Nominal gear deploy 
(If EDW, select MEP) 
AUTO P, R/Y 
Nominal gear deploy 
AUTO P, R/Y 
(0 300 7 EAS, deploy 
gear 
AUTO P, R/Y 
(9 М-0.95, deploy 
деаг 
1For high headwinds at HAC I/C — delay MEP until М-1.5 (EDW); 
CSS at M=1.5 and fly max. L/D until M<0.95; use pitch to fly 1 dot 
hi; fly 4000 ft inside HAC. 


aif speed brake stuck closed, consider nominal aimpoint if landing 
at KSC. 


Fly needles 
Keep EAS <321 


(by pitch) 
Close-in 


Stuck Speed Brake Procedures 


Early Gear Deploy 


If the gear is deployed early (on the HAC), 
3000-ft altitude, manually close the speed brake. 
In general, if the auto speed brake retract 
command is less then 30 percent, expect to land 
short/slow. If the auto retract command is 
greater than 40 percent, expect to land long. At 
main gear touchdown, open the speed brake to 
100%. 


Sensory Cues 


Most crewmembers report a fairly smooth ride 
throughout TAEM to landing, with the 
exception of some buffet during the transonic 
region. On final, the orbiter responds very little 
to turbulence in comparison to the STA due to 
the orbiter’s higher wing loading. 
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When returning from orbit, crewmembers should 
be aware of the potential for some change in 
vestibular sensations. Head movements will 
tend to make these changes more noticeable. 
Flight crewmembers should avoid exaggerated 
head movements during landing to reduce the 
possibility of disorientation. 


Sun glare and residue on the windows from the 
SRB separation motors can reduce visibility 
during landing, especially at low Sun angles. 


Gear deploy causes very little structural vibra- 
tion and may be difficult to detect. 


The orbiter landing gear absorbs touchdown 
loads very well, and for low sink rate landings, 
it may be difficult to feel touchdown. The first 
cue to the middeck crewmembers that the 
orbiter has landed may be the beginning of 
derotation followed by nose gear touchdown. 
For some flights, depending on runway surface, 
vehicle weight, and center of gravity, derotation 
and nose gear touchdown could be quite 
dramatic. 


After returning from orbit, crewmembers need 
to be aware that some degree of decreased 
balance and coordination, as well as dizziness, 
may be experienced when getting out of their 
seats. Studies are in progress to quantify these 
effects and improve current countermeasures. 
At present, crewmembers should exercise 
caution when leaving their seats and preparing 
for egress. 


Autoland 


Although the orbiter has been certified for 
hands-off automatic landings, this capability 
has not been verified. Simulations indicate that 
performance is acceptable under reasonable 
wind conditions for most weight and c.g. 
combinations. 


Although the orbiter may be flown in AUTO for 
the entire approach and landing, CSS control 
until MLS acquisition is recommended. This is 
due to possible transients as the NAV state is 
updated by MLS data. A runway equipped 
with MLS is required for autoland. 
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Based on SMS and STA data, the autoland 
system tightly controls azimuth and elevation 
tracking during the approach. Corrections may 
be abrupt if not close to the nominal trajectory 
when AUTO is selected. 


As with any automatic control system, the 
crew’s task is to monitor the approach and take 
over manually if performance is not acceptable 
or to recover from system failures. Since there 
is no onboard independent monitor, the crew’s 
visual perception of the approach determines 
takeover criteria. This may differ somewhat 
among crewmembers and requires a significant 
number of automatic approaches in the SMS 
and STA to achieve a reasonable level of 
proficiency. Both the HUD and ADI should be 
monitored during the approach. Splitting 
crewmember duties between the pilots has 
proven to be an effective method of monitoring 
autoland performance. 


CAUTION 


Pilots must use extreme care when executing 
a manual takeover from automatic flight 


control after commencement of pre-flare. 
Very little time exists before touchdown to 
damp vehicle attitude transients which may 
be induced by the takeover. 
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Techniques 


After OGS intercept, MLS acquisition, and A/L 
transition, engage AUTO PITCH апа 
ROLL/YAW. Attempt to have ADI error needles 
centered or tracking toward the center position 
prior to engagement. Should a takeover be 
required, the CSS PITCH and ROLL/YAW 
pushbuttons should be used to downmode. 
This avoids undesirable transients caused by a 
“hot-stick” downmode. Takeover should be 
performed only during stable flight conditions, 
if possible. A manual takeover on the OGS or 
IGS is much less demanding than during a 
dynamic phase of the approach such as preflare. 


With good autoland performance, the crew 
should only be required to lower the gear at 
300 ft and apply brakes after nose wheel 
touchdown. Rollout guidance is provided by 
the MLS and lateral control by the NWS. 
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NOTE 


THIS CHART REFLECTS CAPABILITIES AND CONFIGURATIONS WHICH ARE DEPENDENT ON MISSION CHARACTERISTICS; i.e., 
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Navaids/Landing Aids Hi/Low Inclination 
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Terminal Area Energy Management and 
Approach, Landing, and Rollout Rules of 
Thumb 


e A 100 ft difference in gear deploy altitude 


equals about 250 ft of touchdown energy. 
Gear deploy should not be delayed past 
200 feet altitude. 


90 ft of touchdown distance corresponds to 
1 knot of airspeed. 


TAEM guidance uses pitch to control 
glideslope, bank angle to control ground 
track, and speed brake to control energy 
above about 14,000 ft and airspeed below this 
altitude. 


Overhead HAC with NEP allows the most 
downmode options for energy. 


Fly theta limits at Mach 2 (NLT Mach 1.5) if 
air data is not incorporated to G&C. 
Maximum bank angle is 50°. 


OGS is 20? lightweight («222,000 Ib) and 18? 
heavyweight (>222,000 Ib). Aim point is 7500 
ft nominal and 6500 close in. Touchdown 


speed is 205 knots heavyweight and 195 
knots lightweight. When short field speed 
brake is selected, touch. down 10 knots 
slower than nominal. 


Deploy the drag chute at 195 KEAS (after 
main gear touchdown). Start the derotation 
at 185 KEAS using beep trim. At nose gear 
touchdown, manually back up 
WOW/WONG by taking the SRB SEP switch 
to MAN and pushing the pushbutton. 


During training, pilots should strive for a 
threshold crossing height of 20 - 30 feet on 
nominal approaches. Touchdown goals are 
airspeed within *5/-10 knots of the target 
value, sink rate within structural limits, 
negligible lateral drift, and minimal RHC 
activity. А good target value for sink rate is 
3 fps or less, ensuring ample margin before 
violating limits. 


With NWS in NWS 1(2), the orbiter will tend 
to turn into a crosswind. With NWS OFF, the 
orbiter will tend to turn away from a 
crosswind. 


If the orbiter is landing with a known failed 
tire special landing techniques were 
developed to try to save the second tire on 
that axle. 


If both main gear tires fail on one side, the 
orbiter will tend to turn toward that side. 
The turning moment due to crosswind can 
either reinforce or reduce this effect, as will 
the drag chute due to weathervane effects. 


If the turning moments due to tire failure and 
crosswind are in the same directions, large 
control inputs will probably be required. 


If the turning moments due to tire failure and 
crosswind are in opposite directions, the 
control inputs required to counteract tire 
failure will be reduced. In this situation, 
pilots must be careful not to overcontrol. A 
good rule of thumb is to be more cautious 
with the rudder pedal, matching the 
crosswind turning tendency. 


Flight Rules call for landing with an existing 
crosswind on the same side as a known or 
expected bad tire. 
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The most successful teams are those that have 
learned to work together and know each other’s 
responsibilities, strengths, and weaknesses. Ina 
system as complex as the space shuttle, the 
Mission Control Center (MCC), the Launch 
Control Center (LCC), and the flight crew must 
work as an integrated team with each part 
supporting and contributing to the performance 
of the other. 


Each team member must be completely aware 
of his or her responsibilities and realize that 
safety and mission success depend on proper 
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coordination among team members. The duties 
and coordination functions discussed in this 
section are typical of the responsibilities 
assigned by the CDR and the Flight and Launch 
Directors. Specific assignments will vary from 
mission to mission. 


Preplanned decisions that have been approved 
by the Space Shuttle Program are published in 
the Flight Rules and Launch Commit Criteria. 
These are designed to minimize the amount of 
real-time discussions when off-nominal situa- 
tions occur. The Flight Rules also serve as the 
basis for real-time decisions. Rules are devel- 
oped using system performance capabilities 
documented in the Shuttle Operational Data 
Book (SODB), along with program certified 
capability. Where circumstances do not allow 
staying within the operating base (SODB + 
certified capability), the Mission Management 
Team (MMT) may choose to take any necessary 
action to ensure the safety of the crew and 
shuttle. 


During prelaunch and flight operations, the 
MMT chairman is responsible for near-real-time 
policy decision. The launch team and the flight 
teams consult with the MMT chairman as soon 
as possible whenever operations outside the 
shuttle operating base are required. 
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8. INTEGRATED OPERATIONS 8-2 


8.1 FLIGHT CREW DUTIES AND 
COORDINATION 


CONTENTS 


Dynamic Flight Phases 


Orbit Phase 


Dynamic Flight Phases 


For a shuttle flight crew to work well together, 
each crewmember needs to have his or her job 
clearly defined. This definition includes the 
tasks assigned and when they are to be 
performed. Individual responsibilities will be 
assigned by the mission commander based on 
mission requirements. One way in which 
duties might be divided for dynamic flight 
phases is summarized in the following table. 


POSITION PRIMARY SECONDARY 


Trajectory/Nav Communications 
Abort Boundaries * Flight Control Channels 
DPS OMS 
ECLSS RCS 
Nominal Timeline Contingency Abort 
Navaids ** Boundaries * 
Mission Success 
Mission Safety 
Voice Transmissions 

to MCC 


Trajectory/Nav 
Navaids ** 
Mission Success 
Mission Safety 


Voice Transmissions 
to MCC 


Abort Boundaries * 
Navaids ** 
Nominal Timeline 
Reference Data 


Overhead Panels 
Overhead Gauges 
Communications 


Nominal Timeline 
Overhead Panels 
Overhead Gauges 


Contingency Abort 
Boundaries ** 

Photography 

Reference Data 


Stowage Photography 
Middeck Panels/Actions 


Flight Crew Duties for Dynamic Flight Phases 


PLT MPS 
EPS 
APU/HYD 
OMS 
RCS 
Flight Control Channels 


* Ascent only 
** Entry only 


It is critical for the crew to lay out responsibili- 
ties early during training and follow their plan. 
Ав malfunctions occur, the division of 
responsibilities may change. For example, the 
PLT may have to concentrate on the trajectory 
while the CDR deals with an ECLSS malfunc- 
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tion. To ensure the trajectory is being 
monitored, especially during the early portion 
of crew training, the CDR could verbally ask the 
pilot to watch the gauges. As training pro- 
gresses, crews gain an understanding of when 
another crewmember requires assistance and 
usually provide backup without being asked. 


Another way crews work together is to monitor 
keyboard entries and switch throws. By allow- 
ing someone else to check a keyboard entry 
before it is fed to the GPCs or check that the 
correct switch is being actuated before it is 
moved, crewmembers can greatly reduce the 
chance of errors. For crewmembers to provide 
a good crosscheck for each others’ activities, 
they must remain together as they work 
nominal and malfunction procedures. Calling 
out page numbers, procedural titles, and step 
numbers will help everyone follow through the 
procedures. 


During dynamic flight phases, or any time 
when dealing with several malfunctions, it may 
be best to divide into groups or detail 
individuals to separate tasks to successfully 
deal with all problems in a timely manner. The 
CDR usually takes the lead in assigning tasks. 
As the proficiency of crews increases, 
crewmembers often assume responsibility 
without being formally assigned by the CDR. 
Whenever groups/ individuals begin working 
separate problems, they should attempt to 
periodically update the other members of the 
crew on their progress. This is especially 
critical when the problems being worked are 
interrelated. The CDR and PLT must exercise 
care to ensure that at least one member of the 
crew monitors the vehicle trajectory ага 
maintains awareness of the nominal timeline 
when their attention is drawn to different 
problems. 


Orbit Phase 


On orbit tasks are usually less time critical and 
responsibilities are redistributed as necessary. 
It is important that more than one crewmember 
is trained for each flight task to protect for the 
occasion when the prime crewmember might be 
Ш or busy with another task. Mission 
specialists usually assume Ње prime 
responsibility for major payload activities. For 
Spacehab flights, the senior mission specialist 
will be assigned as the Payload Commander 
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1 [EVENT | м 
апа charged with successful payload SS LEBER | CALL 
operations. The following table lists a sample Approach & land, BF trail 


Radar altimeter, 1 & 2 check good 
4,000 


3000 
Boards % 


division of duties for the orbit phase. 


Eya o || | y |} 


2,000, Preflare next 
Preflare, arm the gear 
Gear is armed with a light 


1,000ft ^ kts(PLT call max EAS in preflare) 


Gear down 
Gear coming 
Boards 96, gear is down 


EARTH OBS 
PHOTO/TV 


Prime [Prime Payload | 


CR E ee а 
Payloads 

тоо ше БЕН БЕТ БЕН Бек ЕЛІ БЕН 
ЕС харчин НН [БӘН [ШЕ ӘНЕ ЕЗДЕРІ 


___ knots (steady rhythm) 


Touchdown 
Drag chute (if abort landing or high energy.) 


Drag chute 
1 Prime 185 Derotate 
2 Backup 
z ИЛЫ! "MUR Derotation Pitch rate — (Report at a regular cadence 
On-Orbit Division of Responsibilities байваа Тв, VERE Epo 
Nosegear TD WOW set (Manual by depressing SRB SEP PB) 

Load relief (or no load relief) 
NWS Fail - (if NWS light is on) 

Intercom Protocol ERR — 


5K ft remaining 5,000 ft remaining 


During ascent or entry most crews have a 
standard protocol of voice callouts to help them 
keep track of mission events. Typical callouts ? а od 
and associated displays for ascent and entry аге 

listed in the following tables. 


EVENT CALLOUT 


00:00 SRB Ignition DCR: 
Lift-off/102 

00:30 Throttle Bucket PLT: Landing Comm Protocol 
Throttle down 

01:00 Throttle Up PLT: 
Three at 104 


02:12 SRB Sep DCR: 
Pc < 50, Sep, 103, TMECOs 
converged 


60 kts (£20) Chute (drag chute jettison) 
40 kts 40 kts, ease off 
Wheels Stopped Wheels Stopped 


03:00 MS2: 

EVAP OUT t coming down 
БА 00 МЕСО -30 sec | DCR: 

Coming up оп МЕСО 


РА 32 МЕСО DCR: 
MECO, MECO confirm, ET sep, 104, 
check targets 

10:32 MECO +2:00 РЕТ 
Dump/start 


Ascent Displays and Callouts 
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CONTROL 


CONTENTS 


MCC Resources 
Operations Monitoring and 


Control 
Air-to-Ground Voice 

Communications 
Telemetry Uplink 


To work well together, the flight crew and MCC 
must be aware of each other's capabilities. 
Integrated simulations, where members practice 
their roles on an actual mission, are one way in 
which the team members learn about each 
other. Another way is for members of the flight 
crew to observe in MCC during integrated 
simulations and for Flight Controllers to ride 
along and observe flight crews operating in the 
Shuttle Mission Simulator (SMS). 


MCC Resources 


While visiting MCC, crewmembers will notice 
that an immense amount of downlist data is 
available for Flight Controllers to analyze the 
performance of orbiter systems and follow 
mission activities. Тһе downlist data is 
formatted on various displays with orbiter DPS 
keyboard entries, fault messages, and switch 
discretes available, as well as numerical 
parameters. Many of the parameters in the 
downlist data stream are not displayed onboard 
the orbiter. The flight control team also has 
access to inputs from the customer, direction 
from NASA management, weather observations 
and forecasts, engineering test data and 
analysis, systems performance histories, and 
radar tracking data. 


To properly utilize this data, personnel are 
divided into groups concentrating on specific 
vehicle systems or operational functions, with 
each group led by a Flight Controller. The 
Flight Controllers pass information and 
recommendations over the intercom voice loops 
to the Flight Director. The Flight Director uses 
the information to make decisions on the proper 
conduct of the mission, and manages the flow 
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of information to the crew via the CAPCOM or 
uplink commands. 


Operations Monitoring and Control 


Optimum MCC performance depends оп 
successful receipt of telemetry and tracking data. 
Orbiter DPS or instrumentation failures, as well as 
communications failures, can quickly degrade the 
amount of assistance available from the ground. 
If possible, the CAPCOM will inform the crew 
whenever downlist data is lost or regained. 


To track the crew's progress through the 
nominal timeline, Flight Controllers observe 
individual crew keyboard entries and switch 
throws via MCC displays. It is usually possible 
for the ground to follow the crew's progress 
without voice calls, but an occasional status call 
can be helpful. The crew can also help the 
ground by closely following the nominal 
timeline and by loading maneuvers with future 
start times well before they are required. 


MCC will try to anticipate points in the timeline 
where an MCC GO is required for the crew to 
proceed, and call before the crew reaches that 
point. Ш the crew reaches a point where ап 
MCC GO is required before MCC calls, they 
should ask for a GO. 


When malfunctions occur, the controllers in 
MCC will usually see a trend develop in their 
data before the crew hears an onboard alarm. 
Whenever possible, and especially on orbit, 
MCC will attempt to warn the crew and advise 
a course of action before a fault message occurs. 
For failures that occur more rapidly, the crew 
will see a fault message first and the ground 
will see the problem a few seconds later in the 
telemetry data stream. After a few seconds to 
diagnose the problem, the responsible Flight 
Controller will advise the Flight Director on the 
proper course of action. On direction from the 
Flight Director, the CAPCOM will then relay 
the necessary information to the crew. Usually 
this transmission will include instructions to 
follow a procedure in the FDF, specific switch 
actions, or information on why a false alarm 
occurred. CAPCOMs will strive to use the 
precise FDF procedural titles and the same 
switch nomenclature listed on orbiter panels to 
minimize confusion. If the situation permits, 
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the CAPCOM will also try to pass to the crew 
the rationale for the decisions that have been 
made, especially those involving resources not 
available to the crew. 


Air-to-Ground Voice Communications 


Flight crews should be aware that the 
monitoring of crew voice calls is given very 
high priority in MCC. Whenever the crew calls 
on air-to-ground, all discussions cease on the 
Flight Director's loop in order to concentrate on 
the crew's transmission. Crew calls to inform 
MCC of fault messages or advise the ground on 
progress through normal procedures сап 
interrupt information flow in MCC. Advisory 
calls on progress through nominal procedures 
should be reserved for periods of reduced 
communications activity or for when the 
ground is having problems with downlist data. 
For confirmation of  noncritical system 
problems, one plan that works well is to wait 15 
to 20 seconds after the appearance of a 
noncritical fault message before calling the 
ground. This allows the ground time to digest 
the problem and call the crew, without 
interruption. Waiting for MCC to make the first 
call when noncritical fault messages occur 
should result in the quickest possible problem 
confirmation. 


Of course, flight crew calls can be extremely 
helpful when MCC is experiencing data 
problems or when failures occur which require 
immediate attention. A crew call in these 
instances will focus MCC's attention on the 
problem brought up by the crew. Following are 
some appropriate calls to MCC that are not 
specifically required by procedure: 


Acknowledging MCC transmissions. 


• Reporting deviations from the timeline 
or from a procedure. 


е  Beginning/Ending postinsertion, 
deorbit prep, or major payload activities. 


e Beginning/Ending malfunction proce- 
dures. (This call is generally not made 
for critical malfunctions or during 
periods of high workload.) 


e Beginning major DPS reconfigurations 
or cockpit switch configurations. 
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e Shutting down а main engine, APU, or 
fuel cell, or taking electrical buses off 
line unless previously directed by 
MCC. 


e Reporting engine failure, fire, DPS set 
splits, or flight control problems. 
(These problems may not be immedi- 
ately apparent in downlist data.) 


e Reporting any problem the crew desires 
MCC to give immediate attention. 


• Calling MCC prior to MDM рог 
mode/ power cycle. 


e Changing telemetry formats. 


e Switching to alternate ACCU or 


PCMMU. 


e Reporting headset, CCU, or ATU 
problems. 


If practical, flight crews should obtain MCC 
confirmation of a malfunction before working a 
malfunction procedure. By the same token, 
crews should call MCC whenever beginning a 
malfunction procedure for deviating from the 
nominal timeline without MCC direction, if the 
pace of activities and communication status 
permits. During periods of high activity, MCC 
will assume that the flight crew is prioritizing 
problems and automatically working the 
necessary malfunction procedures as problems 
arise. In these cases, MCC will save voice 
confirmation and direction to work malfunction 
procedures for the most critical problems. 


To minimize verbiage and confusion, standard 
phraseology is frequently used in calls between 
the orbiter and MCC. Some of these calls are 
summarized in the table on the next page. 
Standard abort mode boundary calls are 
presented in Section 6, Emergency Procedures. 


Unplanned downmodes to manual flight 
control should be discussed with MCC if time 
and flight control performance permit. 


Aborts or redesignation of landing site/runway 
should only be performed at the direction of 
МСС if air-to-ground communication 15 
available. If air-to-ground communication is 
not available, or if mission safety is in question, 
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the CDR assumes ultimate authority for mission 
decisions. In this case, the crew will use 
onboard procedures and flight rule summaries 
to take whatever action is required to safely 
conclude the mission. 


CALL 
Your transmission has been received. 
Will comply with received instructions. 


MEANING 


Say again/repeat Repeat your last transmission. 


Read back Repeat the list of information just 
transmitted. 


Good read-back The information just repeated was correct 


Stand by Wait, we will have an answer or be ready 
to listen shortly. 


Stand by on the xx Wait, we will have a plan of 
procedure procedure/action soon, do not execute the 
хх procedure. 


Hold Stop executing the mentioned procedure 
at the current step. 
You have permission to execute 


The xx system is The xx system is working adequately. 

go 

Expect ratty comm Expect degraded communication due to... 
due to... 


Lost data MCC has lost vehicle downlink data, 
expect reduced MCC troubleshooting 
assistance. 

Regained data MCC has regained downlist data. 

...UHF only MCC or orbiter transmitting or receiving on 
UHF only. May also mean loss of orbiter 
downlink data. 

Comm check Voice communication check, acknowledge 
and describe quality of transmission. 

LOS Loss of signal/without comm. Sometimes 
used to mean star/object no longer in 
view. 

AOS Acquisition of signal/good comm. Some- 
times used to mean star/object in view. 

Abort Execute the...abort mode. MCC will also 
uplink an abort light. 


...in the blind We can't hear you, but we're transmitting, 
hoping that you can hear us. 


Take TACAN Accept TACAN for use by NAV software. 

Take Air Data Accept Air Data information for use by 
NAV and GNC software 

Go...CSS Take pitch and/or roll/yaw CSS as called. 

Go...Auto Return to Auto Pitch and/or Roll/Yaw flight 
control. For Orbit Ops, select Auto DAP. 

Check DAP... Ensure the DAP mode matches the mode 
mentioned in call. 


Standard Air-to-Ground Voice Calls 
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Telemetry Uplink 


Ш addition to voice communication, МСС has 
the capability to electronically uplink informa- 
tion to the orbiter. This capability is frequently 
used to reduce crew workload, uplink large 
amounts of information, or to uplink informa- 
tion where accuracy is critical. Crews may 
request that MCC uplink information rather 
than using a voice transmission if they feel it 
would be beneficial and if there is sufficient 
time for the ground to prepare the uplink. In 
extreme cases, the MCC also has the capability 
to uplink keyboard entries to the orbiter GPCs 
in the form of DEU equivalent uplinks. 
Common uplink information is shown below: 


e Communication system configuration 
commands. 


e State vector updates. 


e Table maintenance block updates 
(TMBU) to alter software caution and 
warning limits. 


e IMU compensation. 
e OMS burn targets. 
e Alternate landing site information. 


e TIPS messages for daily execute 
packages. Contains flight plan and 
procedural changes, amplifying infor- 
mation, news from home, systems, and 
consumables status. 


e Unscheduled TIPS messages contain- 
ing information not conveniently 
passed using voice transmission. 
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8. INTEGRATED OPERATIONS 8.2-4 
8.2 Working with Mission Control 


8.3 PRELAUNCH 


CONTENTS 


Flight Crew 


Mission Control Center 
Launch Control Center 


Prelaunch activities begin at KSC with the start 
of the launch countdown. Relative to the 
responsibilities of the flight crew as they relate 
to the LCC and MCC teams, prelaunch is 
considered to start at flight crew arrival at KSC. 


Flight Crew 


Crew activities at KSC are outlined in a letter 
promulgated by the Director of Flight Crew 
Operations Directorate (FCOD). АП activities 
are coordinated by the FCOD Vehicle Integra- 
tion Test Office. Each mission has different 
timelines, and activities vary among pilots, 
mission specialists, and payload specialists. 


The flight crew is subject to Health Stabilization 
Plan restrictions. These limit direct contact to a 
small group of individuals who are especially 
badged as Primary Contacts. Thus, exposure of 
the crew to communicable diseases with short 
incubation periods is minimized. 


Туріса! activities for the flight crew at KSC 
include: 


Shuttle systems briefing 
Countdown status briefing 
STA flights 

Weather briefing 

FDF review 

Preflight physical exam 
Equipment checks 

T-38 flights 


Unless mission requirements dictate a different 
timeline, the crew will arrive at KSC 3 days 
prior to launch. Circadian shifts are performed 
during this period, except for flights requiring 
large shifts and 24-hour operations. Those 
crews start their circadian shift prior to 
departing Houston. 


Crew activities are conducted per a relaxed 
timeline until the actual launch day, when the 
schedule is tightly controlled. Basically, crew 
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members are responsible for their scheduled 
events. 


Mission Control Center 


The MCC is in a monitor mode for most of the 
launch countdown. Active participation is re- 
quired for communication checks, weather 
coordination, and inputs to the Mission 
Management Team (MMT) on shuttle systems 
anomalies. 


Flight controllers and MCC support personnel 
are responsible for their own readiness for flight. 
This includes console and computer systems 
configuration апа checks. All necessary 
materials required to support flight operations 
are positioned. The MCC shift teams usually 
begin their circadian shift during the countdown. 


Launch Control Center 


LCC personnel man consoles around the clock 
once the launch countdown commences. Each 
shuttle and ground system is monitored by one 
or more members of the launch team. The count- 
down is managed by an Orbiter Test Conductor 
(OTC) who has responsibility for 
accomplishment of all steps listed in the 
countdown Operations апа Maintenance 
Instructions (OMI). Prelaunch OMIs implement 
checkout requirements designed to demonstrate 
operation of all testable subsystems within 
prescribed limits. The launch countdown OMI is 
performed under strict quality control. Any 
deviation is documented and must be accounted 
for, either by repair, replacement, or a waiver 
from the MMT. In certain areas, launch may be 
permitted with equipment losses, provided they 
are well understood to be isolated occurrences 
and not symptomatic of a generic problem. 


LCC responsibilities include the conduct of the 
countdown OMI under the OTC’s direction, 
systems monitoring, test and checkout, record- 
ing any deviations, making recommendations 
on system problems, and ensuring any 
violations of the Launch Commit Criteria are 
brought to the attention of the Launch Director. 


The launch team is stationed in one of the firing 
rooms of the Launch Control Center building at 
KSC. 
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8. INTEGRATED OPERATIONS 8.3-2 
8.3 Prelaunch 


8.4 LAUNCH 


CONTENTS 


Flight Crew 


Mission Control Center 
Launch Control Center 


Shuttle launches are complex interactive tasks, 
where each member of the LCC, MCC, and 
flight crew performs an integral part. For 
purposes of discussing responsibilities of each 
element, launch activities are considered to start 
at flight crew ingress into the shuttle. 


Flight Crew 


The flight crew enters the orbiter about 2 hours 
45 minutes before launch. Prior to ingress, final 
weather and systems briefings are conducted 
and the crew dons their advanced crew escape 
system (ACES) suits. 


Ingress is accomplished with the assistance of a 
suit technician and an astronaut support person 
(ASP). These individuals are part of the 
closeout crew who perform final shuttle checks 
on the launch pad. 


Upon completion of ingress, activities are 
governed by the FDF Ascent Checklist, which 
summarizes crew tasks from the countdown 
OMI. These activities are presented in Section 
5. 


Crew responsibilities include responding to 
LCC and MCC requests per the checklist. 
Emergency procedures аге discussed іп 
Section 6. 


As the launch countdown progresses, crew- 
members will be asked to configure certain 
systems and make various keyboard entries. 
This direction will come from the OTC via air- 
to-ground loops. The NASA Test Director 
(NTD) may also communicate with the crew via 
air-to-ground loops, especially if an off-nominal 
situation occurs. MCC inputs are voiced to the 
crew by the CAPCOM, who also utilizes the air- 
to-ground loops. The crew normally uses air to 
ground to respond to LCC or MCC calls during 
the launch count. 
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The LCC has the capability to transmit to the 
crew using A/G 1, A/G 2, or A/A loops. 
Normally, only one loop is used at a time. The 
MCC transmits simultaneously on all three 
loops. Occasionally, this causes an echo 
because of different time delays. The crew 
should report this phenomenon to MCC 
because the delays can be adjusted in real time 
to remove the echo. Normally the LCC ОБ 212 
loop, which is used for the direction of launch 
activities, will be patched into the A/G loop for 
the crew to monitor. 


The LCC also has the capability to talk and 
listen on ICOM 1 and ICOM 2. Transmission on 
these loops is restricted to a small number of 
consoles in the Firing Room. If the LCC enables 
a patch, the entire launch team can receive 
ICOM conversation. This patch is normally 
disabled. ICOM is used only as an emergency 
backup to the A/G and A/A loops. The ICOM 
loops are routed through the T-0 umbilical. 
A/G and A/A loops are RF transmissions 
through the MILA ground station. 


Weather aircraft observations may be patched 
directly into one of the RF loops if necessary. 
This will allow the shuttle crew to communicate 
directly with the weather aircraft crew. 


Certain other consoles in the LCC have the 
capability to transmit directly to the crew. 
These include the Launch Director, Landing 
Recovery Director, and Shuttle Operations 
Director. 


All voice loops are recorded continuously. This 
includes both ICOM loops, all three RF loops, 
and all LCC/MCC channels. 


The maximum time the crew will remain in the 
shuttle in the event of a launch scrub is 5 hours 
15 minutes, excluding safing and egress time. 
This allows 2-1/2 hours of hold time after the 
earliest planned launch time. 


Prior to actuation of any shuttle switches or 
controls other than those called out in the 
checklist, the crew should inform the OTC. This 
will prevent the LCC team from recording an 
unplanned configuration change that could cause 
a launch hold. This is particularly important in 
the final minutes of the countdown. 
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Mission Control Center 


The MCC Flight Director is responsible for 
calling a launch “hold” for all problems that 
jeopardize the ability to safely monitor and 
recover the shuttle and crew after launch. This 
includes problems in: 


e MCC 

e Spacecraft tracking and data network 
e Landing area facilities 

e Abort landing area weather 


In addition, the Flight Director is responsible 
for overall control of the MCC command uplink 
capability. 


Individual flight controllers are responsible for 
monitoring their systems and interfacing in real 
time with their counterparts in the LCC. 


Launch Control Center 


The LCC Launch Director is responsible for 
giving the launch team the final go for launch. 
A formal poll of all elements is taken by the 
chairman of the MMT during a planned count- 
down hold at T-9 minutes. If all elements are 
go, the Launch Director is given permission to 
proceed with the launch countdown. 


The Launch Director is also responsible for 
making a decision on weather acceptability at 
the launch pad for ascent trajectory. 


When the countdown clock is restarted at T-9 
minutes, all operations are under control of a 
computer system called the ground launch 
sequencer (GLS). Shuttle systems are automati- 
cally configured and monitored by the GLS. 


Preplanned hold points for troubleshooting are 
available in the final 9 minutes of the 
countdown. These hold points, called GLS 
milestones, allow the countdown clock to be 
restarted without recycling back to some 
previous time. GLS milestones are shown in the 
following table. 
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TIME TO 
LAUNCH 


GLS sequence start 


EVENT 


If a hold command is issued between T-9 
minutes and T-31 seconds, the countdown clock 
will be restarted upon successful resolution of 
the problem without a “GO” survey made of all 
elements. After T-31 seconds, only a cutoff is 
available. Cutoff will result in a recycle to T-20 
minutes. | Depending on launch window, 
another launch attempt may be possible. 


At T-31 seconds, the GLS issues a command to 
the onboard GPC Redundant Set Launch 
Sequencer (RSLS) software. This command, GO 
FOR AUTO SEQUENCE START, enables the 
RSLS to reconfigure certain onboard systems 
such as the vent doors, start the main engines, 
and issue the SRB ignition commands. 
Throughout this period, the GLS continuously 
monitors various system parameters and will 
issue an automatic cutoff should the Launch 
Commit Criteria be violated. 


If a cutoff command is issued, the RSLS will 
automatically shift control back to the GLS. A 
program is then automatically started, which 
safes the shuttle systems. If this GLS safing 
program does not run automatically, then LCC 
controllers safe the systems manually by issuing 
appropriate commands. 


Throughout the countdown, individual LCC 
controllers are responsible for monitoring their 
systems and executing commands per the 
countdown OMI. Any deviations or anomalies 
are reported to the OTC. 
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CONTENTS 


Flight Crew 
Mission Control Center 


The ascent flight phase starts at SRB ignition and 
continues through OMS-2 cutoff. This is one of 
the most dynamic phases of a shuttle flight. 


Flight Crew 


The flight crew is responsible for monitoring 
vehicle performance and systems and executing 
procedures on the nominal timeline. Flight crew 
and MCC coordination is most critical in this 
phase of flight because of the time-critical nature 
of most activities. General crew and MCC 
coordination is discussed in Sections 8.1 and 8.2. 


Mission Control Center 


The Flight Director is responsible for overall 
direction of shuttle flights from SRB ignition until 
crew egress after landing. The Flight Director, 
after analysis of the flight condition, may choose 
to take any necessary real-time action required to 
ensure the safety of the crew and shuttle. 
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MCC has the prime responsibility for abort 
mode determination, since the abort region 
determinator (ARD) program can assess shuttle 
abort capabilities in real time. Data from 
independent ground radar tracking, along with 
telemetry of the current onboard state, is used 
in the ARD. 


Each flight controller on the MCC team has 
specific responsibilities, based on discipline. 
For example, the Booster Officer monitors SRB, 
SSME, and MPS performance and informs 
the Flight Director of malfunctions апа 
recommended actions. 


Many voice loops are used within the MCC. All 
controllers have a responsibility to monitor the 
Flight Director loop and air-to-ground loops, in 
addition to their own internal and external 
communication loops. Because the workload 
can be quite high during off-nominal situations, 
the crew can help by minimizing air-to-ground 
calls when possible. Also, allowing time for the 
MCC to formulate an action, coordinate it 
among several disciplines, and transmit it back 
to the crew prior to making additional 
transmission will aid in MCC/crew teamwork. 
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8.6 ORBIT 


CONTENTS 


Flight Crew 


Mission Control Center 


The orbit flight phase starts at OMS-2 cutoff and 
continues through deorbit burn ignition. 
Nearly all mission objectives are accomplished 
during the orbit phase. 


Flight Crew 


The crew is responsible for monitoring vehicle 
systems and executing the nominal timeline. 
Operating primary and secondary payloads is 
the major user of available time. This is the 
most benign portion of a shuttle mission in that 
time is usually available to perform in-depth 
troubleshooting of any malfunctions. Crews 
and MCC will take advantage of the available 
time to thoroughly troubleshoot malfunctions. 
General crew and MCC coordination is 
discussed in Sections 8.1 and 8.2. 


Execution of on-orbit tasks, as called out in the 
Flight Plan and other FDF documents, is the 
responsibility of the crew. Some tasks must be 
accomplished on а very strict timeline. 
Deployment of a payload or experiment 
operations fall into this category. Other 
activities are not time critical. For example, 
crew exercise can be accomplished on a not-to- 
interfere basis. 


Based on preflight assignments and training, 
each crewmember will have certain 
responsibilities. Most crews designate backup 
crewmembers for critical activities. These 
backup crewmembers receive nearly all of the 
training that the prime crewmember receives. 
This policy provides the necessary redundancy 
that might be required in the event of 
unforeseen circumstances, such as an injured 
crewmember or an unplanned contingency. A 
typical list of duty assignments is shown in 
Section 8.1. 
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Mission Control Center 


The MCC is responsible for onboard navigation 
maintenance. Adequate navigation and maneu- 
ver definition will be maintained onboard to 
provide runway landing capability after loss of 
communication. The Flight Rules specify 
navigation state requirements. 


Individual flight controllers monitor onboard 
systems and make recommendations to the 
Flight Director for any changes or reconfig- 
uration. In some cases, uplink commands may 
be used to perform certain tasks such as 
antenna management or limit changes (to 
prevent nuisance alarms). 


The Flight Activities Officer and the Payloads 
Officer are responsible for tracking the Flight 
Plan and payload activities, respectively. When 
there is a remote Payload Operations Control 
Center (РОСС), responsibility for the major 
payload activity (such as Spacehab) resides 
with the POCC Director. Other payloads, such 
as middeck experiments, are still controlled by 
the MCC Payloads Officer. Changes to the 
Flight Plan, updates to the orbiter attitude and 
pointing, and replanning are the responsibility 
of the Flight Activities Officer. 


The Integrated Communications Officer (INCO) 
in the MCC is responsible for operation of the 
MCC and shuttle command system. Status of 
the communications link and the command 
system is included in this responsibility. The 
INCO is the designated control point and 
representative of the Flight Director for 
approval of all types of commands, including 
those sent to payloads. With the exception of 
routine communications systems commands 
and nonhazardous commands, most command 
uplinks directly affect the systems being used 
by the flight crew for control of the orbiter or 
payload. To ensure that the flight crew has 
current shuttle and payload system status, if 
communication is lost MCC has а 
responsibility to inform the flight crew when 
command uplinks are transmitted. Typically, 
several hundred commands are sent during 
each mission. The majority of these are 
transparent to the crew and do not require 
coordination. 
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8.7 ЕМТКУ 


CONTENTS 


Flight Crew 
Mission Control Center 


The second dynamic phase of a shuttle mission 
is entry. For purposes of discussing team 
responsibilities, entry activities are considered 
to start at deorbit burn ignition and continue 
through rollout. 


Flight Crew 


The crew is responsible for monitoring vehicle 
trajectory and systems and execution of the 
nominal timeline. The pace of activities during 
entry is generally not as severe аз that 
experienced during ascent until the beginning of 
TAEM. Depending on inclination and altitude, 
communication with MCC may not be available 
for the deorbit burn and part of entry. Crews 
should be mentally prepared to carry out mission 
activities without MCC assistance during the 
deorbit burn and early portion of entry. 


Crew duty assignments during entry are similar 
to those for ascent. General crew coordination 
and working with MCC are discussed in 
Sections 8.1 and 8.2. 
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Mission Control Center 


MCC has the prime responsibility for deorbit 
burn targets. Factors in the selection include 
shuttle systems status, consumables, c.g. 
control, weather, and other landing site 
information. Although the crew has onboard 
capability to generate deorbit targets in an 
emergency, the MCC team, with their extensive 
capability, will normally calculate and uplink 
planned targets. 


Upon completion of the deorbit burn, MCC is 
responsible for monitoring the entry trajectory 
and status of the onboard systems. Should a 
malfunction occur and be confirmed by the 
MCC, the crew is expected to work the 
appropriate cue card or pocket checklist 
procedure with no further direction. Activities 
outside the published procedures will be 
requested by the MCC. 


If the trajectory diverges and approaches energy 
limits, the Flight Dynamics Officer will perform 
a ground controlled approach (ССА). 
Procedures are discussed in Section 7.3. 


The communication workload during entry is 
similar to ascent with numerous loops in use. 
The crew can help to simplify the process by 
minimizing air-to-ground calls and allowing 
time for the MCC to develop a coordinated 
decision. 
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CONTENTS 


Flight Crew 


Mission Control Center 
Launch Control Center 


Postlanding activities start at completion of 
rollout and continue through crew egress. The 
LCC and convoy commander have certain 
responsibilities during this phase. 


Flight Crew 


After wheels stop, crew activities are controlled 
by the FDF Entry Checklist which summarizes 
crew procedures from the postlanding OMI. 
Normal activities include shuttle safing and 
systems reconfiguration for extended power up. 
These are described in Section 5, Normal 
Procedures. 


The crew responds to MCC requests for 
activities outside the normal procedures. For 
example, certain reconfiguration procedures 
might be modified because of previous systems 
failures. 


Communication with the convoy commander is 
established shortly after wheels stop. The 
convoy commander controls  postlanding 
activities in the vicinity of the shuttle and can 
pass information about hazardous situations to 
the flight crew. 
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Mission Control Center 


The MCC retains responsibility for orbiter 
systems until crew egress or ground support 
equipment (GSE) cooling activation, whichever 
occurs later. At this time the Flight Director 
hands over control to the responsible NASA 
Kennedy Space Center (КОС) ground 
operations representative. For KSC landings, 
this representative will be the Landing 
Recovery Director (LRD); at DFRC/Edwards 
AFB it will be the NASA Convoy Commander 
(NCC); and at the White Sands Space Harbor 
(WSSH) or any TAL site, it will be the Ground 
Operations Manager (GOM). Should MCC 
voice and telemetry be lost, or if an emergency 
crew egress is required, handover to the 


LRD/NCC/GOM (аз appropriate) will be 
accomplished ASAP. 
While the MCC 15 controlling ground 


operations, flight controllers are responsible for 
monitoring their systems and interfacing in real 
time with their counterparts in the LCC. 


Launch Control Center 


Until handover, the LCC monitors the progress 
of shuttle safing and reconfiguration. LCC data 
monitoring is available to the LRD/NCC (KSC 
and DFRC only) if loss of MCC system insight 
and communications capability occurs. In this 
case, handover will occur ASAP so that normal 
postlanding operations can continue. Should 
LCC monitoring capability be lost, the MCC 
will continue to support until LCC capability is 
regained or the shuttle is powered down. 


Once handover is complete, the LRD (if KSC) or 
NCC (if DFRC) or GOM (if WSSH or TAL) have 
responsibility for all shuttle activities. The OTC 
coordinates completion of — postlanding 
procedures and preparation for turnaround 
operations. 
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9. РЕКЕОКМАМСЕ 
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91 


9.2 
9.3 


This section contains information regarding the 
performance capability of the space shuttle 
during ascent, orbit, and entry (EI to wheels 
stop). Some performance related material is 
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also included. The information presented is 
accurate but is usually derived from 
representative 28.5° and 57° missions. It is not 
intended for mission planning. The information 
is presented only for the purpose of broadening 
the crew's fundamental understanding of the 
vehicle's performance capabilities during each 
flight phase under the stated conditions. 
Mission-specific questions or requests for more 
detailed explanations should be referred to the 
appropriate Flight Design and Dynamics 
Division (DM) personnel. 
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91 ASCENT Payload 


The graphs below indicate the maximum 
weight payload that can be launched to a 
Payload : particular circular orbit with а 28.59 or 57° 
Launch Window : inclination. Also shown is the higher altitude 
Squatcheloids : capability of a direct insertion versus standard 
Main Engines | insertion mission profile, as well as the 
Altitude, Velocity, and Dynamic performance increase available using 109 
Pressure . percent versus 104 percent main engine power. 
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Launch Window 


The launch window for а ground-up 
rendezvous mission must satisfy several 
constraints. A major factor determining the 
window is ensuring that the orbiter has 
sufficient performance capability (plus reserves) 
to achieve a coplanar orbit. The chart at the 
right (for а 51.6? mission) indicates the 
additional performance required if the launch 
occurs other than at the "in-plane" time. Also 
shown is available propellant that allows a 
10-minute window. 


The launch window developed for each shuttle 
mission delineates the period in which the 
orbiter can be launched without violating 
shuttle and/or payload constraints. Whenever 
possible, launch windows will protect daylight 
(sunset + 15 min) for abort and end-of-mission 
(EOM) landings. The following chart depict the 
launch windows for a shuttle to ISS mission. 
The launch windows for STS-121 is constrained 
by many factors as shown. 


This Rendezvous Mission Performance chart for 
STS-114 shows approximately 2000 pounds fuel 
in flight performance reserve (FPR) when 
launching mid-window, or in-plane. Launching 
other than in-plane creates the need to steer to 
the rendezvous plane, which uses additional 
fuel. To be exact, 2003.80 pounds of additional 
fuel is required to launch at the open or close of 
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the window. The “P” indicates the performance 
degrade for launch holds inside of MPS drain- 
back. Also shown is the STS-114 mission that 
has two panes inside of their window on this 
day. A very close look at the chart will show 
launch time is January 17 (the 017th day of the 
year) at 03:11:13 GMT at the in-plane point 
Pane 1. Further, a move from Pane 1 to Pane 2 
is planned after 3 minutes and 18 seconds if in a 
launch hold. Pane 2 will close 7 minutes and 47 
seconds after the Pane 1 in-plane point. Pane 2 
closes (which would equate to a launch scrub 
for that day) at 017/03:19:00. 
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Mission Duration = 114142 
Inclination = 51.6 

ОМ52 ћаћр = 124 х 85 пті. 
Target ha/hp = 195 x 185 nmi. 
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Squatcheloids 


Squatcheloids are curves that define the q-alpha 
(product of dynamic pressure (q)) and angle of 
attack (alpha) and q-beta (product of dynamic 
pressure) and sideslip angle (beta) limits of the 
orbiter first stage ascent. These q-alpha and 
q-beta limits are determined by the design 
limits of various orbiter structural components. 
The graphs show three representative 
squatcheloids for Mach 0.6, 1.25, and 2.20. 
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Mach = 2.20 Restricted Squatcheloid and IVBC 
Loads Squatcheloid 
Main Engines 


Prior to each mission, after day-of-launch winds 
and propellant loadings are known, the main 
engine propellant at МЕСО is calculated 
(including dispersions). The Space Shuttle Pro- 
gram Flight Performance Reserve (FPR) is the 
difference between propellant loaded and 
propellant required for the ascent profile. The 
FPR normally used for mission planning is 
4652 lb. The FPR must be positive when 
recalculated on launch day using measured 
wind data. 
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The chart below shows the difference between 
planned and actual MPS propellant usage for 
several shuttle missions. 
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Main Engine Actual vs. Predicted Performance 


One percent MPS propellant is approximately 
equal to 15,310 Ib of LO2/LH2. 


Altitude, Velocity, and Dynamic Pressure 


The following three charts depict ascent 
altitude, velocity, and dynamic pressure as a 
function of MET for actual 28.5° and 57° 
missions. 
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MECO Targets 


The direct insertion MECO target line charts 
depict the inertial velocity and inertial flight 
path angle required for various apogee altitudes 
for 28.5° and 57° missions. 


> 
by 57.0 Degree 


ET Impact 


The following map shows the projected ET impact 
areas for 28.5° and 57° (<190 and >190 n. mi.) 
standard and direct insertion missions given 
nominal performance and a nominal ET separation. 
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ASCENT/ABORT SUMMARY (116 OCFR1 CYC) 
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Ascent/Abort Summary Cue Card 


Abort Mode Boundaries 


Abort mode boundaries can be discovered via 
the Ascent/Abort Summary Cue Card. An 
Ascent/ Abort Summary Cue Card is created for 
each mission. It is part of the Ascent Checklist 
on pages 2-42 and CC 10-26 (unflown versions). 
It can be found in its flown version on the 
eyebrow panel (F-2 and F-4) just below the 
HUD. It depicts the abort options available 
from lift-off until MECO. This cue card will 
direct the crew to the proper procedure after 
one, two, or three main engine failures 
(simultaneously) at any time during the 
nominal profile. Locating inertial velocity or 
MET of engine failure(s) along the bottom scale 
will correspond to the appropriate abort mode 
for that Vi/ MET. 


Minimum Safe Orbit 


If the orbiter is inserted into an off-nominal 
orbit, Mission Control will ensure that the 
vehicle has sufficient orbital lifetime. The 
lowest perigee that will guarantee the minimum 
orbital lifetime is a function of apogee and the 
delta time to the next prime  deorbit 
opportunity. Reference Flight Rule 4-51 for 
more details. The following chart shows 
approximate time on orbit versus apogee and 
perigee for low inclination insertion. 


9, PERFORMANCE 
9.1 Ascent 


USA007587 


Rev. A 
= 
= 
Ф 
Ф 
> 
Ф 
а 

ЕВ 

4-51 


60 


9. PERFORMANCE 


9.1 Ascent 


Orbit Geometry 
Inclination: 
Entry Interface: 


Models 
Atmosphere: 
Geopotential 
Dra 
Geomagnetic Index: 


Vehicle Description 


Weight: 
Frontal Area: 


Software 


g 
Solar Flux (10.7 cm): 


28.5 degrees 
400,000 feet 


MODIFIED JACCHIA 1970 
GEM 10 TRUNCATED 7X7 


4.0 


200,000 pounds 
2500 square feet, nominal, inertial hold 


24 Hour Stay 
12 Hour Stay 


Commit to Planned Deorbit 
12 Hour Stay (No Backup Deorbit) (36) 
(24 


Commit to Deorbit 
12 Hours to Entry Interface 


Houston Operations Predictor/Estimator (HOPE) Version 2.6 
Apogee and perigee altitudes match the MCC Vector Compare output 


200 


Apogee (NM) 


Minimum Safe HP vs. HA 


9.1-10 


CONSTANT AREA, Cd-2, K-factor=1.3 
240E-22 watts/square meter/hz 


Time to EI (hrs) 
(72) 
(60) 
(48) 


) 
(12) 
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Drag 


Aerodynamic drag is a factor that must be 
considered when planning on-orbit perform- 
ance capabilities. This is taken into account by 
Mission Control in evaluating orbital lifetime. 
The following chart indicates the incremental 
velocities required to maintain a specified orbit 
during a 24 hr period. Notice that the velocity 
requirement is approaching 0 at 160 n. mi. 
(nominal orbital altitude). 


Orbital Altitude (NM) 


Cp Average = 1.8 


Weight = 180,000 Ibs 
Velocity = 26,000 FPS 


0 10 20 30 40 50 60 70 


Orbital Drag Chute Coefficient (Ср) 


Incremental Velocity Required to 
Maintain Orbit (FPS per 24 hrs) 
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Aerodynamic Drag Effect On 
Orbital Velocity Chart 


Period 


As orbital altitude increases, the time it takes 
the shuttle to complete a full orbit also 
increases, independent of inclination. The fol- 
lowing chart plots these approximate times 
(orbital periods) for various orbital altitudes. 
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Orbital Period vs. Altitude 


Perturbations 


While each orbital period takes approximately 
87 - 96 minutes, the Earth has completed a 
fraction of its full 360° rotation per day. That 
fractional portion will cause subsequent 
groundtracks to be displaced westward an 


equivalent amount, based on this simple 
formula: 
Westward 
Displacement 
360 deg x Тћг x period min = deg 
24 hr 60 min 1 orbit 1 orbit 


Given an 87- to 96-minute range of periods, 
each successive orbit will be displaced 21.75° to 
24° west with about 22.5° nominal (160 n. mi. 
orbit). 
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If the orbiter's track were influenced only by the 
period of the orbit, at the end of the 16th orbit 
(90-minute period), the track would be expected 
to go directly over the launch site. This does not 
occur due to another force influencing the orbit. 
Nodal regression will shift the track approxi- 
mately 7.5° west (for a 28.5° X 160 n. mi. orbit) 
each 24 hr. This force on the vehicle is caused by 
the gravitational impact of the equatorial bulge. 
The chart below depicts the nodal regression for 
various low-Earth orbits. It can be seen that 


9.2 Orbit 


OMS/RCS 


On orbit, the vehicle's performance capability is 
dictated by the amount of usable OMS/RCS 
propellant minus the amount required for 
deorbit, entry, and reserve. This performance 
capability can be maximized by using the most 
efficient burns possible for mission accomplish- 
ment and attitude/altitude control. The charts 
on the next page provide a convenient "quick 
look" method for determining the performance 


higher orbital altitudes and inclinations diminish Penalty for OMS/RCS use. 
the amount of the perturbation. 
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2 
1% OMS = 130 165 propellant AVERAGE ORBITER ACCELERATION (FT/SEC?) 
RCS OMS 
0, = 2 Е 
1% RCS = 22 Ibs propellant ORBTER +х X | хү +Z 2 
WEIGHT | HIGH | NORM| NORM! NORM] HIGH | NORM| LOW | HIGH | NORM| TWO | ONE 
(1000 LB) 1 2 2,2 1,2 2 1,2 2 3 1,2 ENG | ENG 


180 |0.61 | 0.31 | 0.32 | 0.22 | 1.29 | 0.43 | 0.05 | 0.98 | 0.61 | 2.14 | 1.07 
200 |0.55 | 0.28 | 0.29 | 0.20 | 1.16 | 0.39 | 0.05 | 0.88 | 0.55] 1.93 | 0.97 
220 |0.50 | 0.25 | 0.26 | 0.18 | 1.06 | 0.35 | 0.04 | 0.80 | 0.50 | 1.75 | 0.88 
240 |0.46 |0.23 | 0.24 | 0.17 | 0.99 | 0.33 | 0.04 | 0.72 | 0.46 | 1.60 | 0.80 
260 |0.42 | 0.21 | 0.22 | 0.16 | 0.94 | 0.32 | 0.04 | 0.65 | 0.42 | 1.48 | 0.74 


DAP CODE 1 = TRANSITION 2 = ON ORBIT 3 = ЕТ SEP ONLY 
PROPELLANT USAGE TO START, MAINTAIN, 
AND STOP А 115 DEGREE 
ROTATION MANEUVER (LB) 
AVERAGE ORBITER ACCELERATION 
(ОЕСЈЗЕФ ) ROTATION ROLL PITCH YAW 3-AXIS 
RATE 

rotation | norm | LOW PRCS JETS | (DEG/SEC) | РАО | АЕТ | ЕМО | АЕТ | РАО | АЕТ | FWD | AFT 
MANEUVER | PRCS | РМО | АРТ | YRCS VRCS| 02 | 14| 57| 2.0 65/16 | 83| 2.0] 9.6 
+ Roll 0.923 0.021 PRCS 0.2 10.3 | 23.9 |13.1|28.3 9.0 |20.3 | 8.8 (20.2 
+ Pitch 1.230 | 0.696 | 0.534 |0.019 РВС5 0.5 8.2 |20.7 | 10.0 | 19.4 10.2 (21.0 (10.6 (18.2 
- Р СП 0.851 | 0.478 | 0.373 | 0.008 РВС5 1.0 6.8 | 23.7 | 12.9 | 22.4 13.2 24.1 16.5 26.9 
+ Уам 0.703 | 0.449 | 0.242 | 0.014 РВС5 2.0 6.4 | 34.2 | 22.0 | 32.7 21.0 (36.6 (30.2 45.5 

PROPELLANT USAGE FOR TRANSLATION MANEUVERS (LB/FPS) 
RCS 
WEIGHT 
INCHES/100 LB (100018) | FWD | AFT | FWD | AFT | FWD | AFT | FWD | AFT | FWD | AFT | РМО | дет | OMS 
x У 0.2 0.5 | 20.8 | 19.6 | 4.1 (8.6 25.2 | 7.5 | 12.5 |140.0 |117.0 | 10.5 | 18.9 | 17.9 
Sdn j e0 02 | 05 |23.1|218 | 54 | 9.3 |27.4 | 81 | 14.1 |159.0|132.0 | 11.3 | 212 | 19.8 
FRCS | -0.36 0 0.5 0.5 | 25.4 | 24.0 | 6.1 | 10.0 | 29.6 | 8.7 | 15.7 |178.0|147.0 | 12.1 | 23.5 | 21.8 
ARCS | +0.11 | 0.04 1.0 0.5 | 27.7 | 26.2 | 7.1 | 10.7 | 31.8 | 9.3 | 17.3 |197.0|162.0 | 12.9 | 25.8 | 23.8 
ОМ5 | +0.13 | 0.04 2.0 0.5 | 30.0 | 28.4 | 8.1 | 114 | 34.0 | 9.9 | 18.9 |216.0|177.0| 13.7 | 28.1 | 25.8 
PRIMARY RCS THRUSTERS PROPELLANT USAGE (LB/HOUR) 
(ATTITUDE DEADBANDS = 3.5 DEG/AXIS) 
100 NM 120 NM 150 NM 200 NM 300 NM 
ORBITER 

ORIENTATION FWD AFT FWD АЕТ FWD AFT FWD AFT FWD AFT 

Х-рор inertial | 10.5 | 20.2 | 10.2 | 19.8| 9.8 | 19.3 9.3 | 18.6 | 8.8 | 18.0 

Ү-рор inertial | 11.0 | 24.0 | 10.2 | 199| 9.4 | 177 8.4 | 157 | 7.6 |14.6 

Z-pop inertial 8.6 | 21.0 | 8.6 | 20.2] 8.6 | 19.3 8.6 | 18.5 | 8.6 |18.0 

Х-рор -Z-LV 9.8 | 21.2 | 9.3 | 20.8| 8.4 | 20.4 7.3 | 19.8 | 60 | 19.0 

Y-pop -Z-LV 10.3 | 18.0 | 10.1 | 17.8} 9.8 | 17.5 9.5 | 17.1 | 9.1 |16.5 

-X sol inertial | 10.4 | 20.8 | 10.4 | 20.4 | 10.4 | 19.9 | 10.4 | 19.4 |10.4 | 19.0 

-Z sol inertial | 10.0 | 19.9 | 10.0 | 19.9| 10.0 | 19.9 | 10.0 | 19.9 10.0 | 19.9 

X-PSL PTC 9.3 | 19.0 | 9.3 | 19.0] 9.3 | 190 9.3 | 19.0 | 9.3 |190 

МЕНМЕН RCS THRUSTERS PROPELLANT USAGE (LB/HOUR) 
(ATTITUDE DEADBANDS = 1.0 DEG/AXIS) 
100 NM 120 NM 150 NM 200 NM 300 NM 
ORBITER 

ORIENTATION FWD AFT FWD АРТ FWD AFT FWD AFT FWD AFT 

X-pop inertial | 3.0 |11.6 | 1.5 | 5.7 | 0.9 | 3.8 | 0.7 | 3.0 | 0.6 | 2.8 

THRUST PROP PROP Y-pop inertial 1.9 6.3 | 1.6 4.7 1.5 4.5 1.4 4.3 1.3 3.9 

SPECIFIC] РЕВ FLOW | MIXTURE Z-pop inertial | 29 |115 | 2.0 | 81 | 16 | 68 1.5 | 65 114 | 59 

IMPULSE | ENGINE RATE RATIO X-pop -Z-LV 4.1 |13.3 | 1.6 5.1 0.7 1.3 0.4 0.6 | 04 0.4 

ENGINE | (SEC) (LB) (LB/SEC) | (OX/FU) Y-pop -Z-LV 0.5 1.0 | 0.5 | 0.8 | 0.5 | 07 | 0.5 | 06 | 05 | 0.5 

ОМ5 313.2 6000 19.16 1.65 -Х sol inertial 2.9 | 10.6 | 2.2 7.7 18 6.7 18 65 |18 6.1 

РВС5 280.0 870 3.11 1.60 -2 sol inertial 3.6 8.8 | 2.6 5.5 2.3 4.8 2.2 47 | 2.2 4.5 

VRCS 265.0 24 0.09 1.60 X-PSL PTC 5.6 | 10.9 | 4.8 7.2 4.2 4.9 3.8 3.4 | 4.3 3.6 
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Trajectory 

Entry History 

Entry RCS Use Data 


Rollout/ Braking 

Loss of Braking 

Rollout History 

Performance Rules of Thumb 


Downrange/Crossrange 


TAL, emergency deorbit, or a waveoff to the 
secondary landing site can result in mission- 
critical assessments of the orbiter’s downrange 
and crossrange capabilities. Once the orbiter 
has committed to its descent, only a carefully 
flown profile can put it on the runway safely. 


The orbiter begins entry at EI (400,000 ft) on 
average 4,176 n. mi. from the landing site. 
Given a crossrange situation of about 500 n. mi. 
(414 n. mi. being the average), the vehicle has 
the ability to stretch the descent approximately 
800 n. mi. downrange by flying a lower drag 
profile. TPS thermal constraints prevent the 
use of lower angles of attack. The orbiter 
remains in the equilibrium glide phase longer, 
likely bypassing the constant drag phase 
altogether. Ш the crossrange requirement is 
reduced below this arbitrary (but realistic) 
number, the downrange can be increased 
slightly. 


Тһе downrange can be reduced by approxi- 
mately 1,100 n. mi. (again given a 500 n. mi. 
crossrange) by flying higher drag profile. This 
results in higher temperatures on the TPS as the 
vehicle descends more quickly into the atmos- 
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descent, as the vehicle’s mach and alpha 
decrease, maximum drag is limited by “5” 
(~ Mach 16) and eventually q-bar (~ Mach 5), 


thereby limiting downrange reduction. 


In the event of an emergency deorbit, the 
orbiter’s crossrange capability becomes а 
significant factor. The following charts list the 
dispersed and undispersed crossrange limits for 
28.5° and 57° missions at the stated entry 
weights. The dispersed crossrange limits pro- 
tect for 3-sigma entry dispersions. However, for 
an emergency deorbit, the crew could deorbit to 
a landing site that is within the undispersed 
crossrange limit if there were no site within the 
dispersed limit. 
Dispersed 


APPROACH | RANGE 
DIRECTION N. MI. ANC 
crossrange limits 
Ascending, left 753 28.59 
Descending, ей | 753 | 160 и. mi. orbit, 197 k Ib 


АРРВОАСН RANGE 
DIRECTION N. MI. 


Dispersed 
crossrange limits 


Ascending, left 815 28.5°, 
Descending, ей | 815 | 160 и. mi. orbit, 197 k Ib 


APPROACH RANGE 
DIRECTION М. МІ. 


Ascending, left Dispersed 


Asceñding, right crossrange limits 


Descending, left 579, 
160 n. mi. orbit, 217 k Ib 


Descending, 
right 


APPROACH | RANGE 
DIRECTION М. МІ. 
Ascending, left Undispersed 


Ascending, right crossrange limits 


Descending, left 57°, 
160 n. mi. orbit, 217 k Ib 


Descending, 
right 


phere. TPS thermal constraints are the initial 
limiting factor in this profile. During the 
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Trajectory 


The following chart plots nominal performance 
in terms of altitude, VREL, q-bar, flight path 
angle, g, and alpha against time from EI. 


Entry History 


The following table lists flight history perform- 
ance and performance related data for the first 
74 space shuttle missions. 


Entry RCS Use Data 


Typically, the orbiter deorbits with 
approximately 50 percent aft RCS (ARCS) 
propellant in each pod (~1100 Ib). Prior to OI-26 


and wraparound DAP, RCS propellant use 
during entry averaged about 13 percent (600 Ib) 
of full ARCS tanks. Since the implementation of 
wrap DAP, aft RCS usage has averaged 16 
percent (350 15) total aft usage. Certain 
missions are selected to conduct Program Test 
Inputs (PTIs), which are modifications to flight 
control software to collect entry performance 
data. In addition to nominal RCS use, other jet 
firings are used to collect RCS PTI data or to 
correct for  aerosurface РТБ. Missions 
conducting PTIs will typically use in excess of 
23 percent (1000 Ib) of full ARCS tanks during 
entry. Analysis of actual versus predicted use is 
ongoing. 
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5 - Report containing data not аз yet published 


a - Data not Available - DOD Mission 
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b - Report containing data not as yet published 


Orbit Entry Trajectory (continued) 
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Source: JSC/DMS Flight Design and Dynamics Division, 
Descent Post-flight summaries 


Orbit Entry Trajectory (concluded) 


- Data not Available - DOD Mission 
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Rollout/Braking The structural carbon brakes, while по 
dramatically reducing the braking distance (300 
to 500 ft), substantially improve the energy 
absorption capability over the old 


The design rollout figure depicts a nominal 
touchdown to wheels stop profile for a 15 K ft 


ENS beryllium/carbon brakes. Vibration induced 
brake damage and heat damage (including heat 
Loss of Braking induced blown tires) has been virtually 


eliminated. АП orbiters are equipped with 
Some general comments сап be made about the structural carbon brakes. 

impact of the drag chute. The 40 ft partially 

reefed chute deployed 75 ft behind the lower Rollout History 

trailing edge of the vertical tail can reduce the 

orbiter’s stopping distance 2.5K to 3.5K ft. It The Landing Rollout Flight History Table 
provides increased directional control with two reflects the landing environment and the 
blown tires (NWS engaged) and іп the absence — Orbiters performance from main gear 
of NWS will greatly reduce the speed at which touchdown to wheels stop for the first 97 shuttle | 
the vehicle departs the runway. It also will missions. 

significantly reduce the speed at which a heavy 

weight orbiter engages the barrier at a TAL site. 


Design Profile for a 15000 ft Runway 


Rollout Phases : 
(1) All runways with all 


Attitude systems up 


Hold pou cd Pra ging (2) No barrier with either 
(~8° о) (-2°/зес) (- -6 fps) (-9 fps no nosewheel steering 
or only 50% braking 
Mimimum , , 2000 ft 
Rollout 
140 0 Margin e 
195 180 -160 KGS KGS Required 
KEAS KEAS KEAS Begin Wheels Barri 
= Threshold Wowlon Derotate Wong Braking Stop 2000 ft мэ 
T Го] [s 
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Performance Rules of Thumb 


ASCENT 


DESCENT 


PROPELLANT 


Ascent Performance Margin 
Management Reserve Reg. (105) 
Pre Flight Design Requirements 
Document = 3500 
Flight Design Requirements 
Document = 2500 
Cargo Integration Review = 1500 
Flight Planning Stowage 
Review = 1500 
FPR = 4652 
ORBIT 


1 hr launch delay = change in 
orbital noon by 4 minutes 


Ascending node 

28.5 deg - 1st ascending node 
is @ Long = 173.38 East 
57 deg = 121.55 West 


MISCELLANEOUS 


Orbiters 

OV103 - Discovery 
OV104 - Atlantis 
OV105 - Endeavor 


Min planned flt duration - 96 hours 


Max/Min Beta Angle 
Max = 23.5 + orbital inclination 
Min - 23.5 - orbital inclination 
lime 
CDT = СМТ - 5 г 
CST = СМТ - 6 hr 
Daylight savings time from 
1st Sunday in April to 
last Sunday in October 


Хса Limits 

FWD = 1076.7 in (RTLS = 1079.0 in) 
AFT = 1109.0 in 

CONT AFT = 1119.0 in 


D/O Delta V's 

Descending approach is worst case AV 

90 deg prebank will decrease AV ~ 10 ft/s 
(function of altitude) 


If Xcg > 1091.5: 1 in Xcg = 2.2 miles 

If Xcg < 1091.5: 1 in Xcg = 1.1 miles 

As Xcg increases (more aft), XR decreases 

1 nm XR = 5780 Ibs EI weight 

1 nm XR - 4.38 nm D/O altitude 

As altitude and weight increase, XR increases 

As inclination increases, XR increases (non-linear) 
As temp increases, XR increases (non-linear) 


Touchdown speeds 
195 kts if TD weight < 222 К Ibs 


205 kts if TD weight > 222 k Ibs 


10 kts slower if short field speedbrake 
guidance mode is used if 200 k Ib « TD weight 
< 245 К Ibs 


И 


; 


2: > E 


Derotation 185 KGS with beep trim (Prime) 
or with RHC (manual ) derotation (Backup) 


Mass Moment 
MM - TD Weight * (1172.3 - Xcg)/12 
for medium lakebed runways 
If MM > 1.47 M ft-Ibs Concrete desire 
If MM > 1.54 M ft-Ibs Concrete required 
Note: If TD Xcg not known, use 

Хеда @ М = 3.5 + 1.5 іп 


Landing Weight Limits 
EOM 233 К Ibs 


RTLS 242 - 248 k Ibs * 

TAL 241 - 248 k Ibs * 

AOA 233 - 240 k Ibs * 

(Abort limits a function of Inclination) 


Noctilucent Clouds 
If Inc > 50, do not enter on descending opportunity 
June through August. 


RENDEZVOUS 


1 deg of phasing/hour = 10 nm of A height 

1 deg of phasing = 60 nm 

17.5 ft/s burn changes other side of orbit 10 nm 
440 ft/s burn will change plane by 1 deg of wedge 
1 deg of ARAAN occurs for each relative lap 


1 deg of plane change = 440 ft/s 


OMS philosophy 
1 ft/s = 21.8 lbs OMS Q 220 k Ibs ~1/6% 
1.78 ft/s = 1 пт 


Maximum OMS load 
ОУ103/4 = 25064 Ibs 

Min = 10800 Ibs 

Max OMS ballast = 4000 Ibs 
1% OMS = 130 Ibs/side 


Hard Ballast 
OV103/104 - Bay 13 


RCS philosophy 

1 ft/s = 25 Ibs (+ X) ог 35 - 40 Ibs 
(multi axis) @ 220 К Ibs 

Max burn = 250 sec = 55 fps 

Full FRCS = 2446 Ibs 

ET blowdown offload = 2225 Ibs 

Min FRCS - 1862 Ibs 

Full ARCS = 4970 Ibs (over 100%) 

1% ARCS = 22 Ibs/side 


IINTERCONNECT logic 

If OMS < 14,000 Ibs, ИС off 

If OMS > 17,000 Ibs, I/C on 

If 14 К < OMS < 17 К, analysis req. 


ECS - N2 


OV103/4 

5.28 Ibs/day for 4 person crew @ 14.7 psi 
add .114 Ibs/day for additional crewmember 
3.66 Ibs/day for 4 person crew @ 10.2 psi 
add .079 Ibs/day for additional crewmember 


Dry wt 
83 Ibm 


Eully loaded wt 
143 Ibm 


N2 
EPS 
.09 Ibm Hydrogen = 1 kwh 


Л Ibm Oxygen = 1 kwh 
.07 Ibm Oxygen/hour - cabin leak rate 


Dry wt Eully loaded wt 
H2 227 Ibm 319 Ibm 
02 215 Ibm 996 Ibm 


* Orbiter Engineering Memo VE3-90-096. 
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APPENDIX B DISPLAYS AND General Information 
CONTROLS 

This Orbiter Displays Reference Guide is 

for information only as it pertains to CRT 

and HUD displays. The guide was devel- 

oped as a quick-reference tool for person- 

nel supporting tests involving Orbiter dis- 

plays. It provides the CRT displays docu- 

е 5 mented іп the November 8, 2005 Level С 
Orbiter Displays Functional Subsystem Software Require- 
ments (FSSR) Display and Controls Speci- 


Re ference fication, STS 83-0020-32, with an effectiv- 


ity of OI-32 and subs. This guide also pro- 
Guide vides System Management (SM) mission 
reconfigurable displays documented in the 
baseline version of JSC-19590 Level C 
Flight Software Requirements document. 
Please note the SM displays are mission 
reconfigurable and there could be changes 


Space Shuttle Orbiter to the displays subsequent to STS-120. 
Displays and Controls This reference guide reflects the incorpora- 
(CRT & HUD) tion of approved Software Change Re- 


quests (SCR’s) listed in SCR 98085D - 
Flight Software Release Baseline Specifica- 
tion: OI-32. For more detailed information, 
refer to the above-mentioned documents. 
For information regarding the publication 

OI-32 and distribution of this guide, contact 
Jose Rosa (821-861-4658) or Pete Wilson 
(321-861-4656). 


July 2007 How To Use This Guide 


The CRT and HUD displays are listed in 
alphabetical order by title. The CRT dis- 
plays are shown with their OPS availability 
and type. The tables on the next four 
pages will provide assistance in locating a 
specific CRT and HUD display quickly, in- 
^: cluding СЕТ displays related to Initial Pro- 
(BOEING T gram Load (IPL). There are also tables pro- 
zn vided in descending order according to hi- 
erarchy of OPS, SPEC and DISP for the 
CRT displays. 
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Contents A - Alphabetical 


Primary Avionics Software GNC SM ІРІ, 
System (PASS) Display [9] 1] 2]3] 618|9| o| 2] 4 9| Page 
Actuator Control x 1A 
Antenna хх 1B 
APU/Environ Therm* x 1С 
APU/HYD* x 1D 
Communications* x 2B 
Controllers x 2C 
Controls x хх 20 
CRYO Pallet /Cargo* x 3B 
CRYO System* x 3c 
DAP Config 3D 
Docking Status* x 4A 
DPS Utility ххх X| X| X X| X| X 4B 
Electric* x 4c 
Entry TRAJ 1 X| БА 
Entry TRAJ 2 X| 5С 
Entry TRAJ 3 х 6A 
Entry TRAJ 4 X| 6c 
Entry TRAJ 5 X| 7A 
Environment* x 7B 
External Airlock* x 7C 
Fault X| X| X| X| X| X| X| X | X| X| X 8А 
FCS/DED Displays С/О x 8B 
Fuel Cells* x 8C 
GNC Sys SUMM 1 X|x|X| X|x 9A 
GNC Sys SUMM 2 x x 9B 
GND IMU CNTL/MON х ос 
GPC Memory ххх X| X| X| X | X| X| X эр 
GPC/BTU ЦЕ x 10A 
GPC/Bus Status ххх ххх X|X|X| 10B 
GPCF PL C&W хх 10С 
GPCF PL Commanding хх 10D 
GPCF PL Status хх 11А 
GPS Status х|х|х|х|х|х 11D 
GTS Display x Х| 12А 
Horiz Sit (in-left/3 ТАС) x хх 120 
Horiz Sit (in-right/3 ТАС) x хх 13А 
Horiz Sit (out-left/3 ТАС) x хх 13Б 
Horiz Sit (out-right/3 ТАС) x хх 13С 
Horiz Sit (right/3 GPS) x хх 13р 
HYD Thermal* х 15А 
IMU Align хх 15Б 
Manual Controls x 15С 
Mase Memory ВАМ ххх 15D 
NWS Check x 16A 
Orbit TGT x 16B 
Override x хх 160 
PCMMU/PL COMM x хх 17А 
PDRS Control хх 17Б 
PDRS Faults* x 17C 
PDRS Override хх 17D 
PDRS Status* x 18А 
PL Бау Doors хх 18B 
PL Retention* x 180 
Power Transfer x 18D 
PRPLT Thermal* x 19A 
RCS X|Xx|x|x|x 19B 
RCS/RGA/ADTA Test х 19С 
Rel Nav x 190 
RGA/ ADTA/RCS (On-Orbit) x 20A 
RM Orbit x 20B 
RTLS TRAJ 2 ў 20р 
S TRH/COAS CNTL хх 21А 
Sensor Self-Test (3 GPS) x 21Б 
Sensor Self-Test (3 TACAN) х 21С 
Sensor Test (3 GPS] x 21D 
Sensor Test (3 ТАСАМ) x 22A 
SL Memory Dump Х| 22B 
БМ Ground Checkout хх 22С 
SM OIU* х 220 
SM Sys SUMM 1“ x 23B 
SM Sys SUMM 2* X 23D 
5М Table Maint X|X 24А 
Switches x 24Б 
Switch/ Surf x 24C 
TCS Control x 24D 
Time x x хх хх х| 25B 
Universal PTG x 25C 
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Primary Avionics Software 


System (PASS) Display Гот | ГВГӨГ612| 4| e ] Раве 


Vert Sit 1 25D 
Vert Sit 2 26B 
Vert Sit 1 GRTLS 26А 
Vert Sit 2 GRTLS 26С 
ХХХХХ MNVR ҮҮҮҮҮ 27A 
XXXXXX TRAJ 1 27C 
XXXXXX TRAJ 2 28А 


- Mission Reconfigurable 


Backup Flight System (BFS) Displays 


BFS Memory 

CRYO Pallet /Cargo* 3A 
Entry TRAJ 1 x 4D 
Entry TRAJ 2 x 5B 
Entry TRAJ 3 x 5D 
Entry TRAJ 4 х 6В 
Entry TRAJ 5 x 6D 
Fault x x x x 7D 
GNC Sys SUMM 1 x x x SD 
GNC Sys SUMM 2 x x x 9B 
GPS Status x x x 11¢ 
Horiz Sit (single string or no СРЗ] x x x 12B 
Horiz Sit (3 string GPS) x x x 12С 
Override x x x 16C 
PL Bay Doors 18B 
RTLS TRAJ 2 х 20C 
SM Sys SUMM 1 23A 
SM Sys SUMM 2 23C 
Thermal 25А 
Vert Sit 1 25D 
Vert Sit 2 26B 
XXXXX MNVR YYYYY 27A 
ХХХХХХ TRAJ 1 27B 
XXXXXX TRAJ 2 27D 

- Mission Reconfigurable 


Initial Program Load (IPL) Displays 


Display 


XXXXIPL Menu (1) 
GPCIPL Menu (2) 


Head Up Displays 


HUD Display Format 1 After-WOW 


HUD Display Format 1 Pre-WOW 
HUD VU OPS 8 Low 
HUD VU OPS 9 Low 


ОРЕ 


OPS Displays 
| ______ољењу | РАБА srd спој em] pr | Рае 


0001| GPC Memory 9D 
0001| ВЕБ Memory ЗА 
0001 | Thermal 2БА 
1011| XXXXXX Traj 1 270 
1011 | XXXXXX Traj і 27B 
1021| ХХХХХХ Traj і 270 
1021| XXXXXX Traj і 27B 
1031| ХХХХХХ Traj 2 2BA 
1031| XXXXXX Traj 2 270 
1041| ХХХХХ MNVE ҮҮҮҮҮ 27A 
1051| ХХХХХ MNVR YYYYY 27А 
1061| XXXXX MNVR YYYYY 274A 
2011) Antenna 1B 
2011| Univ PTG 25B 
2021| PL Bay Doors 18B 
2021| ХХХХХ MNVR ҮҮҮҮҮ 27A 
3011] XXXXX MNVR YYYYY 27A 
3021| XXXXX MNVE YYYYY 27А 
3031| XXXXX MNVE YYYYY 27A 
3041| Entry Traj 1 5A 
3041] Entry Traj 1 4D 
3041| Entry Traj 2 5c 
3041| Entry Traj 2 5B 
3041] Entry Traj З 6A 
3041| Entry Traj 3 5D 
3041] Entry Traj 4 6c 
3041| Entry Traj 4 6B 
3041| Entry Traj 5 TA 
3041| Entry Traj 5 6D 
3051| Vert Sit 1 25D 
3051| Vert Bit 2 268 
4011| Antenna 1B 
4021| PL Bay Doors 18B 
5011| RTLS Traj 2 20D 
5011| RTLS Traj 2 20с 
6021 | Vert Б 1 250 
5021| Vert Sit 1 GRTLS 26А 
5031 | Vert Sit 1 25D 
6031 | Vert Git 2 26B 
6031| Vert Sit 2 GRTLS 26C 
B011| FCB/DED Displays С/О 8B 
9011| Mazs Memory R/W 15D 
9011| GPC Memory 9D 


*- Mission Reconfigurable 


Vehicle Utility (VU) Displays 


Actuntor Control 
Controllers 
FC&/DED Display С/О 
GND IMU CNTL/MON 
GPC/BTU УЕ 

GTS Display 

Manual Controls 

Mass Memory R/W 


NWE Check 16А 
RC&/RGA/ADTA Test 19С 
Кал/АПТА/ЕСЕ (On-Orbit) БОА 
Sensor Self-Test (3 СРЕ) 218 
Sensor Self-Test (3 ТАСАМ) 21С 


Sensor Test (3 GPS) 

Sensor Test (3 TACAN) 
8L Memory Dump 2208 
Switches 245 
Switch/ Surf рас 
TCS Control 


DPS Utility 
Fault 

GPC Memory 
GPC /Bus Status 
Time 
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SPEC and DISP Displays 


С ne [enne pnt [n 


DP& Utility 

Time 

GPC/Bus Status 

GNC Sys Summ 1 

GNC Бүх Summ 1 

GNC Бух Summ 2 

DAP Config 

IMU Align 

Б.ТЕК/СОАБ CNTL 

ЕСЕ 

ЕМ Orbit 

Rel Nav 

Orbit TGT 

Sensor Test (3 GPS) 
Sensor Test (3 TACAN) 
RGA/ADTA/RC& (On-Orbit) 
Switch/ Surf 
Controllers 

Switches 

NWS Check 

Horiz Bit (in-left/3 TAC) 
Horiz Eit (in-right/3 TAC) 
Horiz Bit (out-left /3 ТАС) 
Horis Bit (out-right /3 TAC) 
Horis Bit (right/3 GPS) 
Horiz Sit (1 string/no GPS) 
Horiz Bit (3 string GPS) 
Override 

Override 

Controls 

GPS Status 

GPS Status 

ЕМ Table Maint 
PCMMU/PL COMM 

PL Bay Doors 

ЕМ Ground Checkout 
Envir onment* 

Electric* 

Cryo System* 

Fuel Cellz* 

GPCF PL Status 

GPCF PL Commanding 
GPCF PL C&W 
Communications* 

ЕМ Sys Summ 17 

ЕМ Sys Summ 1* 

ЕМ Sys Summ 2* 

ЕМ Sys Summ 2% 

Mass Memory R/W 
APU/HYD* 

HYD Thermal* 
APU/Environ Thermal* 
PRPLT Thermal* 

PDR& Control 

PDRE Override* 

PDRE Faults 

PL Retention* 

Fault 

Fault 

ата Display 

Sensor Self-Test (3 GPS) 
Sensor Self-Test (3 TACAN) 
RC&/RGA/ADTA Test 
GND IMU CN TL/MON 
TC8 Control 

Manual Controls 

ЯЛ, Memory Dump 
GPC/BTU I/F 

Actuator Control 
Docking Status* 

Cryo Pallet/Cnrgo* 
Cryo Pallet/Cargo* 
PDRE Status* 

External Airlock* 

$M ОШ 

Power Transfer* 


Барама ра ра ра ра ра ра ре ра ра ра ра ри ра ра ре ра ра ра ра ра Ра 


| раа ра ра ра ра ра ра ра ра ра ра мимиммимимми M ра ра ра ра ра ра ра ре ра ра ра ра ра MH OM 


%- Mission Kesenek ООО 
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ХХХХ/113/ ACTUATOR CONTROL XX X ООО/ННИ:38М:55 1 БРЕ HENORY XX X 000/нн:ым:55 
MONITOR FAIL ODD/HH:MM:55 BFS ООБИНН:МЫ : 55 

смо РОЗ АСТ ACTUATOR GIMBALIKG READ/WRITE 

£XX. 2XX.XX $в RATE 29 ЕЕ ХЕ DEG/SEC DATA 1Х GIT SET 3X SEQ 105 

хх. ®хх.хх RUD FIN POS 30 Ыхх.хх GEG CODE 2X ВІТ AST 4х WRITE 6 

«хх. £XX.XX LIE START 31XXX STOP 32X 7 ENG UNITS EXE HEX 8X 

£XX. £XX.XX RIE STATUS XXXX DESIREO ACTUAL 

xXx. &ХХ.ХХ LOE HYO PR ECP ERR XXX 13354 аХХХХХХХХХХХ 

+ХХ. ®ХХ.ХХ ROE Т ХХХХ BF MON 33x хххх аХХХХХХХХХХХ 

ахх. аХХ.ХХ Р 2 Xxxx XXXX 2XXXXXXXXXXX 

£XX. £XX.XX 17 3 хххх хххх SXXXXXXXXXYX 

хх. £XX.XX 2Р Al S$RB/NW 34x хххх аХХХХХХХХХХХ 

ахх. &XX.XX 2Y ME 150 V XXXX RXXXXXXXXXXX 

exx. ГЭ 3 28 34 ЗР TX 2X 3х FC Lim Сина 

£XX. £XX.XX эү 35 

£XX. £XX.XX RPA RISB RFG/FRT 38X MENORY DUMP LAUNCH BUS 1 26x 

axx. аХХ.ХХ APS MAT P 40М5 37X 21 START ID XIXXIL 2 i7X 

ахх. *ХХ.ХХ AYA МОР СА RFG 38x 22 NUMBER WOS Їїїїїї OFF 28X 

XK. £XX.XX AYS NOP СА FRT зэх 23 WOS/ FRAME Xxx 

.ХХ. #ХХ.ХХ ГРА НОР OMS 49Х DUMP START/STOP 24 PASSIBFS XFER ENA 25Х 

ХХ. £XX.XX LPS SRB S/S LIN 41X 

xXx. ХХ ХХ LYA Et POS Lim 42X BFS TIME UPDATES UPDATE 38 MISSION TIME 

ХХ. ЕХХ.ХХ LYS 518 POS КИМ 43X зо GMT 4 bhixxx/xi: 

xx £XX.XX ВЕ A RATE .5 PCM 44Х 34 МЕТ à hixxx/xx- 


OO б ө 00 00 WO 00 00 Or 0 
e oru о цо ао (л ҳо Cm м CO оъ о 
OOM о цо до о ҳо ow 00 0 су 
Ф ф® ф ко ца ав ко ко бв ко ш оъ О 


20117 XX X DDD/HH:MM:88 хххх/ххх/©76 COMMUNICATIONS хх X DOD/HH:MM:SS 
D00/HH:MM:$8 DOD/HHIMMISS 
KU BAND 1 BAND РМ KU-&AND 


88 X.XXS „во 1А РА ТЕМЕ 
m I $ 9m -99 ји GIMBAL TEMP A 


AUTO 16Х GYRO TEMP 
MIN 17X : Fen ол 


MODE 
FAIL SAFE 
AUTO К TO S 


e" TORS STATE VECTORS OYRO 13X 

SELF TEST 7X ЗАТ 8РС 
110 ВЕЗЕТ ВХХ сон MODE XXXXS UL DATA SOURCE 
xxx DATA RATE XMIT 
TORS KU XXX ххх Tors $ RCV 
А PRI эх ххх А PRI 14X CODING XMIT 
8 PR! 10x ххх В PRI 15Х RCV 

ххх 

ххх STON ххх | 


XEXX/0437 CONTROLLERS XX X DDD/HH:MM:SS 
XXXX/XXX/088  APU/ENVIRON THERM XX X DOD/HHIMMISS 000/HM:MM:$$ 
FREON LOOP 2 


GG SPLY LN XXXS 
нго LN INJ#xxxS 


(C) CONTROLLERS 


ХХХХ/053/ CONTROLS XX X OOO/HH:M 


XX X DOD/HHiMM:SS DDD/HH:M 


DOD/HHiMMiSS 
1 2 


E 

P XXXXS XXXXS XXXXS 

RSVR Т XXXS XXXS ххх5 
P XXXS XXXS XXXS 

ОТҮ XXXS XXXS XXXS 
ACCUM P ХХХХ5 ХХХХ5 ХХХХ5 


ЗЕС АСТ СК PORT STAT PORT STAT 


сна ах 
2x 

зх 

4х 
START 5Х 
STOP ех 


MEG TIN АСТ!СН 


ЕМА 7X 8 BYPASS її 
$ ВЕЗЕТ її 


AGA SURF FDBK 
DES LLES 

тах тех $ 
15x 10x 8 
16x 20х $ 
17x 21x 3 


86 53 о > 


39 

3 m 

20 
заал opa» VD 


2 


T £XXXS £XXX&S +ххх5 
OX) 


(D) APU/HYD (D) Controls 
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ХХХХ/ХХХ/188 CRYO PALLET/CARGO XX X 00D/HH:MM:SS$ 
855 00D/MH:MM;SS 


PALLET TK . М . , 
на PRESS XXXS ХХХ XXXS XXXS 
TK Р XXXS XXXS XXXS XXXS 
02 PRESS ХХХХ6 ХХХХ% XXXX$ XXXX$ 
TK P XXXX8 ХХХХЗ ХХХХ8 XXXX8 
НТА T! XXXS XXXS XXXS aXXXS 
T? ахххв XXXS XXXS аххх 


CARGO LOOP 
ACCUM P 
T 


un T 
НХ OUT P 
1 


(113 28! 


ТИТЕ T 
FLOW RATE 


CRYO PALLET/CARGO XX X ООО/НН1ММ:55 
D00/HHIMM:SS 


XXXX/XXX/068 CRYO SYSTEM XX X DOO/HHIMM:SS 
TK 
1 2 3 4 
хххха хххха хххха хххха. 
£XXXS 
£XXXS 


4/58 


ХХХХ/920/ ОАР CONFIG XX X 000/HH:MM:S8 
Doorn ми : $5 

ххх XXXXXXX| 2 ххххххк PRI DAP EDIT 

ROT RATE X-XXXiX| 30 X.XXXI| 59 1.1111 3 ОАР АКК 

АТТ 08 XX.XX| 31 LEAKE] 51 кі. 4 DAP BEE 

RATE DB [533 xY.xx| 52 X-XL 6 XXXX 

ROT PLS 225433 Х.ХїХ| 53 

COMP 29554 tit 

Р OPTION Xxxx XXXX 

Y OPTION хххх хххх 

ТААН PLS 129595 125353 ЕМА 6X 
ххх 

ЯАТЕ 0% 291133 (25534 XJETS ROT 

ЗЕТ ОРТ ХХХ Xxxx ENA 7X 

* JETS x x 

ON TIME 17133 (2533 REBOOST 

DELAY (32533 (125323 e CFG X 
XXXX 9 !NTVL 

ROT RATE 19553533 12953333 (122133 

АТТ ОВ XX.-XXX 2579955 

ВАТЕ 08 m mr 

ROT PL$ (29333 12953313 

come «XIX XXX 

Сить АСС x x 


(D) DAP CONFIG 
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XXXX/XXX/167 DOCAING STATUS Хх X DOD/HHIMMISS 


ххэ 
XXXXS/XXXXS 

1 г 3 
ххх5 ххх5 


XXXS/XXXS 


Q MN 5/6 AM x ххх 


ХХХХ/001/ Ors UTILITY XX X DOO/KH:MN:SS 
DDD/MM:MN:$8 
MMU ASSIGN PORT ASSIGN 
UL CNTL 
STRING 1 AUTO 36x 
2 ЕНА 36x 
з INH 37х 


4 
РЕ 172 ІР. SOURCE 
MASK 38X 


VAR PARAM 10 LIST 
(3333 
MMU SOURCES ХХХХ 
GPCIMMU ХХХХ 
MMU/IMMU XxXxX RETRIEVE 
(144111) 132333 
XXXX 
CKPT RETRY Xxxx 
ENA 12x хххх 
хххх 
atc хххх 
13 ІШЕК ІШІК 
смо 14 


XXXX/XXX/067 ELECTRIC XX X DOO/HHIMM:SS 
1 а ша и 


3 
ФА ХХХ5 ХХХ5 ХХХ5 
+ XXXS XXXS XXXS 
@C XXXS XXXS XXXS 
ФА ХХ.Х5 ХХ.Х5 ХХ.Х5 


PAYLOAD ОС AMPS 
AFT B XXX. XS 
с XXX.XS 
АРТ £XXXS £XXXS £XXXS 


TOTAL AMPS XXXXS 
Kw XXX. XS 


(C) ELECTRIC 


1 ENTRY TRAJ 1 XX X D0D/HM-MM-$$ 
BFS ODD/HH:MM:S$ 

r у ' 179 эр to 
AS Бі / ё 

REF XX.X 
ххх ‚Хх 

ххх 

ххх 

ххх 


нү X.XXX 
NY TRIM X.XXX 
n XXX 
во, — XX.X 

ZERO Й BIAS 2 
M BIAS аххх 
ВЕР XXX 

ROLL REF  XXXX$ 

смо хххх 


(D) ENTRY TRAJ 1 (BFS) 
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ENTRY ТАА) 1 XX X ООО/НН:МЫ:55 ENTRY TRAJ 3 XX X 000/HH:MM:$8 
0D00/HH:MM:$$ о ——є су Френи ни: 66 


ер | 4» у у А 


ххх 5 хх 
XXXXXXXX XXXXXXXX 
39 3 xxx А 3 ххх 


250 
20 


"Y X.XXX нү X.XXX 
MY TRIM X.XXX NY ТАТЫ X.XXX 
x 


nm x nm 
RUD , XX.X RUD XX.X 
ZERO Й BIAS 2 ZERO Й BIAS 2 
M BIAS аххх Н BIAS axxx 


A аххх REF ахХхХ 
ROLL REF ХХХХ8 4 -13e POLL REF ХХХХ8 
смо хххх CMO хххх 


! ENTRY TRAJ 2 XX X DDD/WH:MM:$8$ ENTRY TRAJ 4 XX X 000/HM:MM:S8$ 
$ BFS DDO/HM:MM:$$ о 7. ers 52442711 мы: 1: 
350 250 100 400 39 


, 


BIAS (хх BIAS [xx 

REF XX.X REF ХХ.Х 
XXX.X d 

ххх 

ххх 

ххх 


нү TRIM Х. ХХХ 
хх. х . 
RUD , — XX.X RUD , — XX.X 
ZERO Й BIAS 2 1480 Й BIAS 2 
BIAS aXXX Н BIAS аххх 
ВЕР xxx REF аххх 
а ROLL REF XXXXS А ROLL АЕР XXXXS 
смо хххх смо хххх 


ENTRY TRAJ ? XX X 000/MH:MM:58$ ENTRY TRAJ 4 XX X D00/MMH:MM:SS 


DOD/WM:MM:88 о у. оооуин:мм 
350 250 200 400 
é v 


55 
300 


xxx 
XXXXXXXX 
39 3 xxx 


Y х.х нү x.XXX 
NY TRIM X.XXX NY TRIM X.XXX 
AIL . v See” Att XXX 


RUD , хх.х RUD хх,х 
ZERO Й BIAS 2 ZERO Й BIAS 2 
BIAS aXXX Ñ BIAS аххх 

аххх ВЕР аххх 
o ROLL ВЕР  XXXXS 4 -230 ROLL REF XXXXS 
смо XXKX смо хххх 


ENTRY ТЯА 3 XX X 000/HH:MM:$8 ENTRY TRAJ 5 XX X 000/MM:MM:$$ 
875 DOO/MM:MM:$$ Е ers ооогни;ми:5% 
350 250 30 20 


нү Хх. хх нү X.XXX 
NY TRIM X.XXX NY TRIM X,XXX 
nm XX.X 
RVO XX.X 
1680 Й BIAS 2 
Ñ BIAS аххх 
REF 
ROLL REF 
«is. смо смо хххх 


(О) ENTRY TRAJ 3 (BES) (D) ENTRY TRAJ 5 (BES) 
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ХХХХ/ХХХ/999 


XX X DOD/MM 
(111113 


ENTRY ТЯА $ XX X 000/HM:MM:58$ 


FAULT Time 


XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXX X 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


XXX IXX: XX: 
XXX IXX:XX: 
XXX ХХ : XX: 
XXX !XX:XX: 
ХХХ/ХХ:ХХ: 
XXX IXX:XX: 
XXX IXX:XX: 
XXX XX : ХХ: 
XXX 1 хх : ХХ : 
XXX XX : XX: 
XXX IXX : XX: 
XXX /XX:XX: 
XXX /XX : ХХ : 
XXX /XX:XX: 
XXX /XX : ХХ : 


XXXXXXXX 
39 3 xxx 


NY TRIM X,XXX 
ИП хх.х 
RUD XX.X 

zgno Й BIAS 2 
SHAS аххх 
REF *ххх 

ROLL REF хххх $ 

смо хххх 


хх«хх«хххххххххх 


-275 


(A) FAULT (PASS) 


80117 FC$/0ED 01$ CIO XX X ООО/ИН:ММ:585 


XXXX/XXX/056 000/HH:MM:SS 


ENVIRONMENT 

CABIN АУ BAY 
dP/dT +.XXS PRESS ХхХ.ХХ5| TEMP 
РРОг А 


XX X рролннамм 55 
DOO/HH1MM:SS 


1 г 3 
XXXXS XXXXS XXXXS 
x х,ХХ5 


DEO 015 
(4,1: 1х 
АРТ 2X 


моо іт 
HIGH он 7х 
Low OFF ВХ 
FLAG 
ОРЕ 


Ауға он эх 


SURF OR START 10x STOP 
FLP DES 
XXX 12x 
XXX 13X 


XXX 14x 


ЗЕС ACT CK 
CH 1 18x 
сна 10x 
cH 3 17x 
CH 4 эх 
STOP 19x 
POS stim 

ЕМА 20X 21 BYPASS 
22 RESET 


SPO ВАК 
SOY FLP 


XX.XS ХХ.Х5 
XX.XS ХХ,Х5 
X08 LT td 


(XX) 


(B) FCS/DED DIS C/O 


ххххиххх/ 069 XX х оролннамм: 55 


DOD/HH:MM:SS 


vu 
TEMP 1/2 ххх/ ххх 


8858 


т 
т 
т 
Р 


2 


зі 2 
LCG SPLY P XX.XXS ХХ.ХХ5 
XFER Р XX.XxS 


Е 35 
ges 


(C) EXTERNAL AIRLOCK 


ХХХХ/ХХХ/099 XX X DOD/HN XXXX/XXX/018 GNO 575 SUMM 1 ~ оу 


BFS обо/нн 
сат тан 


FAULT 


э 
ж 


(113 


t ХХХ.Х8 XX $ 
ХХХ XXXXXXXXXX XXX/XX: 

XXX XXXXXXXXXX XXXIXX: є % TRES 55% > H H ST 
XXX. XXXXXXXXXX XXX/XX: os XXX.X8 XXS 

XXX XXXXXXXXXX XXXIXX: Att XXX.X 

XXX XXXXXXXXXX XXX IXX : RUD XXX.X 

XXX. ХХХХХХХХХХ XXX IXX : 890 ВАК XXX.X $55 
XXX XXXXXXXXXX ХХХ/ХХ: BOY FLP XXX.X 


xxx 
ххх 


ХХХ 


: НЕ TK Р — XXXX$ XXXX$ 
XXX RXNXXEXKERE ХХХ/ХХ: REG P А ХХХХ$ ХХХХ$ ХХХХЗ 
XXX XXXXXXXXXX XXX ХХ 
B XXXX8 XXXX$ XXXX$ 
ХХХ XXXXXXXXXX XXX IXX : 
авга XXXS XXXS XXXS 
XXX XXXXXXXXXX XXXIXX: ape SANG БЕР 
НЕРВЫ XXXIXX: ULL P LH2 XX.X$ XX.XS ХХ.Х8 ЦЭВ XXXX$ 
ххх ХХХЇХХ: 
102 XX.X$ XX.XS XX.X$ REG  XXXX$ 
ХХХ XXXXXXXXXX XXX/XX: ACUM XXXXS 
ХАК ҮГҮТҮ SALINEN бн? OUT P ХХХХ5 XXXXS XXXXS МАНЕ P (на XXXS 
ХХХ EEXZXRNXXX EEEL бо? OUT T XXXXS XXXXS (02 xxxs 


XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXX X 


MMMM MO 
ee ee 


(D) FAULT (BES) 


ХХХ/ХХ: 
ХХХ/ХХ: 
ХХХ/ХХ: 


В-7 


(D) GNC SYS SUMM 1 (ВЕБ) 
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ХХХХ/ХХҮХ/0!4 


GNC SYS SUNM ! XX X DDD/MM:MM 
ооогнн : мм 
RCS JETISOL 
MANFFAILVLV 
TXXX xx 
2XXX xxs 
sxxx xxs 
AXXX xxs 
ххх хх 
t 
2ХХХ xxs 
$XXX xxs 
АХХХ XX$ 


ым з- 


2ХХХ ХХх% 
sxxx xxs 
4ХХХ XX8 
sxxx xxs 


ХХХХ/ХХХ/019 GNC SYS SUMM 2 XX X DOD/MM: 


BPD o00/MM:MM:S$ 
OMS АРТ QTY t R ous ( a 
0Х10 XX.X$ ХХ.Х3 TK P НЕ ХХХХ$ XXXX$ 
охо XxXxx$ XXXS 
ғу xxxs xxxs 
тк Р ХХХХ$ XXXX$ 
REG р ххх$ хххз 
Р 13] xxs xxs 


IN , 
2822 xxxs 
xxxs 


(B) GNC SYS SUMM 2 (PASS/BFS) 


ХХХХ/194/ оно IMU CNTL/MON хх X ODD/HH: 
000 /HH: 
IMU 4 2 3 
19579535 4 XXX-XX 7 XXX-XX seu imu 
ХХХ.ХХ 6 XXX.XX 8 XXX.XX 
XXX .XX 6 XXX.XX 9 XXX.XX 


ххх. XXX.XX 
XXX. XXX KK 
XXX. XXX.XX 
ххх . ХХХ . ХХ ХХХ .XX 

“Хх ахх.хх 


ххх. ХХ 


ххх. хх MNGR CAL 


АТТ ОЕТ 19x 
А 20% 
ХХХ.ХХ в 21% 
с 22x 
PREFLT CAL 23X 


XX . GYROCOMP гах 


IMERTIAL 25x 
PLAT POS 26x 
TERM/IDLE 27x 


28 MM WRITE 


x 


READ 29Х 
ММ STATUS ХХХХ 
GEN INU 31x 


30 SITE SEL 


x 


ACTUAL ххх 


(С) GND IMU CNTL/MON 


9001/ 1 ОРС MEMORY хх X DDO/MM:MM: 

DDD/MH:MM: 
MEM/BUS CONFIG 
1 CONFIG XX(XX) 


299 5 СКХ 


READ/WRITE xxx 
DATA 20X BIT SET 22Х SEQ 10 
COOE 21X ВІТ RST 23X WRITE 
26 ENG UNITS XXX НЕХ 27X 

DESIRED ACTUAL 

29 XXXX 
81 XXXX 
33 XXXX 
35 XXXX 
37 XXXX 
39 XXXX 


STRING 1 


MEMORY OUMP 
40 START 10 
41 NO WOROS 


STORE 
(33333 45 CONFI 
XXXXXX| 46 GPC X 
STORE 47 


42 WOS/FRAME Xxx 
OUMP START/STOP 43 


KKK MMMM ммкн 


44 DOWNLIST GPC X 
OPS 9 EWA 49 X 


ERR LOG RESET 48 


OPS 3 ШРЕК SOX 
098 3 INIT $1 


(D) GPC MEMORY 


APPENDIX B: DISPLAYS AND CONTROLS В-8 


58 
55 


24 
25 


аХХХХХХХХХХХ 
АХХХХХХХХХХХ 
EXXXXXXXXXXX 
&XXXXXXXXXXX 
EXXXXXXXXXXX 
ӨХХХХХХХХХХХ 


111133 
її 


ХХ X 000/МН:3м:58 
DOD/HH:um:ss 


XXXX 11127 


GPC/IBTU I/F 


BTU SELECTION TEST STATUS 
1X PONNU 12X ХХХХ МОМ OUTPUT TEST 
2х wuyi 13Х BTU ITEM XX MOOULE XX 
3x 2 14Х STEP XXXXXX 

МЕСТ 15Х ROW ХХХХ ANALOG OUTPUTS 
2 16х ВСЕ STAT 80 , XX . 
ЕТО! 17x XXXXXXXX 1 
эх 4 
19Х PORT SEL 1 91x 6 
zox 2 зах 4 
21x 
22x 


DISCRETE 

CHANNEL 0 
CHANNEL 1 
CHANNEL 2 


XXXXXX 

ХХХХХХ 

LEVEL 2 XXXXXX 
МОМ OUTPUT 

CONTROL TERMINATE 


CONTINUE 


это CYCLIC BITE зох 


(A) GPC/BTU ИЕ 


XXXX IXXX/008 GPC/BUS STATUS XX X D0D/HH:MM:SS 


DOD/HM:MM:S$8 


LAUNCH 
сат 


(В) GPC/BUS STATUS 


ХХХХ/9073/ GPCF PL Caw XX X DOD/HH:MM:$8$ 
ХХХХХХ XXX XXXXXX ооо/нн : мм: 53 
1 SELECT PL 10:55 XXXX PRIMARY XXXX ZZ XX 


2 SELECT PL ТЕК XXXX SECONDARY XXXXXXXX 


DESCR 

XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


DESCR VAL DESCR VALUE 
XXXXXXXXXX KS ХХХХХХХХХХ XXXX.X5 
XXXXXXXXXX XXXXXXXXXX XXXX. 
XXXXXXXXXX XXXXXXXXXX хххх. 
XXXXXXXXXX XXXXXXXXXX Xxxx. 
XXXXXXXXXX XXXXXXXXXX хххх. 


XXXXXXXXXX 
XXXX XXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


XXXXXXXXXX XXXX, 
XXXXXXXXXX хххх. 
ХХХХХХХХХХ ХХХХ. 
ХХХХХХХХХХ хххх . 
XXXXXXXXXX хххх, 


XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 
XXXXXXXXXX 


XXXXXXXXXX XxXxX. 
XXXXXXXXXX хххх. 
XXXXXXXXXX XXXX. 
XXXXXXXXXX XXXX. 
XXXXXXXXXX XXXX. 


(C) GPCF PL C&W 


ХХХХ/ 0721 GPCF РЕ COMMANDING XX X D0D/HM:MM:S8 
ХХХХХХ XXXXXX XXX 000/HH:MM':$8 
16 SELECT PL 10:14 — XXXX 


PAYLOAD MAZARDOUS/TIME CRITICAL COMMANDS 


EXE 
CMD HAZ JENA н 


! DESCRIPTION 
(ee 


с 
(99) 
KXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXX XX 
XXXXXX XX XXX E XXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXX XXX XXXXX XX XX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXXXX 
XXXXXXXXXXXXXXXXXX XX 
XXXXXXXXXXXXXXXXXXXX 


MMO OO OO 
хчмхмммхмхххххх Ж 


н 
› 
х 
х 
х 
х 
х 
М 
х 
x 
x 
x 
x 
x 
x 
x 
x 


Hen ою чота м 
MMMM MH ж жм ммм ж мм 
миммимхммимимхимх 


(D) ОРСЕ PL COMMANDING 


ОРСР PL STATUS XX X 000/(НН:ММ:55 
ХХХХХХ XXXXXXXXX 000/HM:MM:$$ 


LAST н 

(23 POSC DESCRIPTION о” 142158308 

XX ХХХХЗ XXXX8 XXXXXXXXXXXXXXX XXS ххх ххх 
ХХХХ$ ХХХХХХХХХХХХХХХ Хх | ххх ххх 
ХХХХ$ ХХХХХХХХХХХХХХХ ххз | ххх ххх 
XXXX$ XXXXXXXXXXXXXXX ххх ххх 
XXXX$ ХХХХХХХХХХХХХХХ ххх ххх 
ХХХХ8 XXXXXXXXXXXXXXX ххх ххх 
ХХХХ5 XXXXXXXXXXXXXXX ххх ххх 
ХХХХ5 ХХХХХХХХХХХХХХХ ххх ххх 
ХХХХ5 ХХХХХХХХХХХХХХХ ххх ххх 
ХХХХ8 ХХХХХХХХХХХХХХХ ххх ххх 
ХХХХ5 ХХХХХХХХХХХХХХХ ххх Ххх 
ХХХХ$ XXXXXXXXXXXXXXX ххх ххх 
ХХХХ8 ХХХХХХХХХХХХХХХ ххх ххх 
ХХХХ8 XXXXXXXXXXXXXXX ххх ххх 
XXXX8. XXXXXXXXXXXXXXX xxx ххх 


ХХХХ/971/ 


PORT 2 ANMUNCIATE 
он 2x 5 
оғғ 4х = 


(А) СРСЕ PL STATUS 


GPCIPL MENU (2)XX X 000/НН:3Мм:58 

DDD/HM:M 8 
STP/PURGE CYC СМТ XXXXX 
ERROR! coot ххх 
141111) 6008 CNT XXXX 
TOTAL ERR/MSG CNT ХХХХ 
MSGS STILL IN LIST ххх 


17 DEY FORMAT LOAD x 


START GPC SELF TEST 16x 
STOP @РС 3 TEST 19Х 
START 060 SELF TEST 20x 


МСО8 BITE 

131334 
XXXX 
хххх 
XXXX 


STOP STP ON ERROR 24x 
CONTINUE STP ON ERROR 25x 
INHIBIT СКРТ КОАО 26x 
осо м ХХХХ ХХХХ ХХХХ ХХХХ 
REGISTER 0-3 ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ XXXXXXXX 
зет 0 4-7 ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ XXXXXXXX 


REGISTER 
ЗЕТ 1 


ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ 
ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ XXXXXXXX 


ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ 
ХХХХХХХХ ХХХХХХХХ ХХХХХХХХ XXXXXXXX 
МІН: ХХ 8ОНЕОМПЛО.«ХХХХХХХХ  CLOCKTeXXXXX 


FLOATING 
МАЈ» XXXKK 


ХХХХ/ХХХ/ GPS STATUS XX X OOO/HH мм: 
BFS DOD/MH:MM: 
Gress 
STAT хххх GPS MINUS МАУ 
NODE хххх ён aXXXXXX ай аххх.хх 
ADR «ХХХХХХ BOR аххх хх 
INIT 14x ACR «ХХХХХХ BCR о аххх.хх 


RESTART 20x x LAT 


хх. хх 


X LON ALT 
ХХХ.ХХ XXX. XXXX 


DES ACVR 26Х 
ОА! OvRO 29X 


GPS TIME ADJUST ЕМА ЗЭХ 
SATELLITES 

тако C! C? сз Са CE CB 

GPSt XX XX XX XX XX XX 

GPS2 XX XX XX XX XX XX 

GP$3 XX XX XX XX XX XX 


DES 43 XX ХК XX Xi 
її XX XX хє 


QA! P 


ХХХХ/655/ GPS STATUS XX X DDD/MM:MM:$8 


000/HM:MM:$8 


110 10 X GP$1$| GP$2 


STAT GPS MINUS МАУ 


MODE АН ҮХХХХХХ АН. аХхХХ.ХХ 

5/1681 ADA «ХХХХХХ BOR aXXX.XX 

INIT АСА «ХХХХХХ OCR aXXX.XX 

МАУ 

RESTART X LAT х LON ALT 
ХХ.ХХ ХХХ ХХ XXX. XXXX 


06 ҒАШ 
DES ЯСҰЯ 26х 
QA OVAD 
SF CAND x 
ФА! P toXXXXX 


AUT INN 
GPS TO GSC $32X ЗЭХ 34x 
GPS TO МАУ $35X 36K Э?Х 
METERING OVERAIOE 3 
GPS TIME AOJUST ENA 3 
SATELLITES 
тако C! C? сз 64 65 C 
Gest XX XX XX XX XX X 
x 
x 


1113 
QAS POS 


6 2 XX XX XX XX XX 
GPSS XX хх 


xx 
хх 


хх хх хх 


OES 43 xx 


xx 


(113 . 
XXX.X LAST SEL FIL UPDATE 


(D) GPS STATUS (PASS) 


XXXX 1100/7 


HOA CONTROL 
ENA 


DES PMU 40X PL 41Х 


878 OISPLAY 


DEO 018? 

1х INH 2х то 18x 
HIGH 20x 
FLAG 22X 


CSL/RML TEST 


UFI 3X 122811 


UF2 4X UFS 7X ENA 25Х 


ЏЕЗ 6x 


IFA ЕХ INH 26x 


9 FAIL GPO ЗЕЕ X 
TEST EXEC 10X 


RESET 11x 
0% FORMAT 
12 SEL XX 
GSE POLL ЕМА 14X 


PASS/BFS XFER 15 


SL COMM 
СН А ЕМА 
8 ЕМА 
058. 
LOAD 18x 


COUPLER 
STATE 
ERR CO 


8:0 TOGGLER 
он 


ХХХХ/0597/ 


16x (14 28123 


CRIT МЕС CMOS 


МОМ TESTS 
атан CHW 
ATAN MSG 


USA007587 
Rev. A 


XX X 000/МН:38:58 
D0D/MH:MM:88 


АРТ 19x 
LOW 21x 
OFF зэх 


DRIVE 24x 


ELEV LUT SEL 
HORZ 27% 
VERT 26x 
OwPs 29x 


ssc exc 
зах 36x 
з1х sex 
зах 37x 


33 XXXX 38 XXXX 
34 XXXX 39 XXXX 


XX XX хххх 
хх хх 


(А) GTS DISPLAY 


HORIZ SIT 


ALTM 
9 xx0xx 


XXXXXXXXXXXX. XX 
XXXX 6116 XX 
XXXXX 3x 
SEC XXXXX 4х 
ТАС ххх 5 


ТАЕМ ТОТ 
GEM X XXXX 6 


ХХХХ/9050/ 


XX X ооо/нн :88 
BFS ОООГНН: мы : $$ 
МАУ DELTA 
AX to 
bIXXXXXX 
AY 11 
Ix x x xxx 
42 12 
Bx xXxxx 
AX 13 
[7 7773 
ay 14 
Bx xxx 
42 16 
Ix xxx 
5040 16 


(В) HORIZ SIT (BFS, SINGLE ОК МО GPS) 


HORIZ SIT 


ALTM 
9 xx0xx 


ХХХХХХХХХХХХ XX 
41 XXXX SITE XX 
PRI XXXXX зх 
SEC XXXXX ax 
ТАЕМ TOT $ 
оён X XXXX 6 ы 
MSI х ° 
ХЕР ? 

Е е 


XXXXXXXXXXXX 


41 
РАІ 


XXXX SITE 


XXXXX 
SEC XXXXX 


ТАС! 
«ХХХ 
аххх ххбаХХХ,ХХ5 


XX X 000/HH:MM:88 
BFS D00D/MM:MM:88 
НАУ ОЕСТА 
ах 10 
ЫХххкхх 
AY 11 
WK XX XXX 
az 12 
Ix xx xxx 
AX 13 
(112123 
AT 14 
lix xx x 
42 15 
BIXXXX 
(713 


1% 


ax 10 
uXXXXXX 
AY 11 
ax XXXxx 


XxX 


(D) HORIZ SIT (IN-LEFT HAC, 3 TACANS) 


APPENDIX В: DISPLAYS AND CONTROLS 


USA007587 
Rev. A 


ХХХХ/ П WORIZ 517 XX.X 000/ЮКН:3М:55 
XXX 1] АКТЫ D00/MH:MM:$8 

INDEX XX 9 XXÜXxx Ieee МАМ DELTA 
$210 ах 10 

XXXXXXXXXXXX XX IXXXXXX 
4% XXXX SITE XX ду 11 

PRI XXXXX зх ыхххххх 
SEC ХХХХХ 4х 4z 12 

ТАС ХХХ 5 ыхххххх 
GPs FOM RA AX 13 
Ax Ix XXX 
ТАЕМ TGT av 14 
бам X XXXX 6 шх X X X 
HSI X 52 15 
ХЕР 2 lax XXX 

дум хххх 6 А T LOAD 16 


5 5 ЯМАХХХХ. x AZaKXX. XX 
-G S47X 48X 49K НХХХ.Х 


(A) HORIZ SIT (IN-RIGHT НАС, 3 TACANS) (A) HUD DISPLAY FORMAT 1 AFTER-WOW 


xx HORIZ SIT XX.X DDO/MM:MM:$8 
РТ! XXX 1] attu 000/НН:3М:58 
INDEX ХХ жээ т], НАУ DELTA 
ах 10 
ХХХХХХАХХХХХАХ ХХ ix XXXXX 
41 XXXX 817€ XX AY аа 
PRE XXXXX эх ок IX XX Xx x 
SEC XXXXX 4х AZ 11 
TAC XXX 5 Шшхххххх 
GPs РОМ RA ak 13 
x 46x o о | шкі 
ТАЕМ TOT av 14 
GAN X XXXX 6 . ыхххх 
нэ! х ° 52 15 
ХЕР , lx XXX 
лм XXXX $ xe ххх 5.0K LOAO 16 
sis XXXXX 39 18 AT шхх0хх 
EPS $ RWaXXXX.X АСАХХХОХХ 
АІҒ-0 S47X 48Х 49X MXXX.X 


(B) HUD DISPLAY FORMAT 1 PRE-WOW 


ХХХ | HORIZ SIF XX.X 000/ИН:3м:55 


D00/HM:MM:$8 
INDEX XX !— —Ü | МАУ DELTA 
ах 10 
XXXXXXXXXXXX 22131113 
41 ХХХХ SITE ay 11 
PRI ХХХХХ шхххххх 
SEC XXXXX az 12 
ТАС ХХХ ҮН 
GPS РОМ aX 13 
[2221 
AEM av 14 
GAR X XXXX 6 ыхххх 
az 15 
ХЕР lix XXX 
LOAD 16 


(C) HUD VU OPS 8 LOW 


ххх 1 ноћи; SIT XX.X орогнн:мм:55 
9T! T] attu 000/MM:MM:8$ 

INDEX XX % XXÜXX Aa DELTA 
зато ах 10 

ХХХХХХХХХХХХ XX ыхххххх 
41 ХХХХ SITE ХХ AY ti 

PRI ХХХХХ зх SOK т эмххххх 
SEC ХХХХХ “х az 12 

dax XXXXX 
ТАЕМ ТӨТ : aX 13 
GAN X XXXX 6 (34444 
HSI X AY 14 
ХЕР 7 lox xxx 
Аты XXXX 8 A2 15 
XXXXX 39 (7 1743 

LOAD 16 


ALT 
XXX.X 


(D) HORIZ SIT (RIGHT HAC, 3 GPS) (D) HUD VU OPS 9 LOW 


APPENDIX B: DISPLAYS AND CONTROLS  B-10 
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ХХХХ/045/ низ СНЕСК XX X 0DD/HH:MM:$8 


D0D/HM:MM:9S5S 


XXXX/XXX/0G87 НҮО THERMAL XX X OOD/HHIMM!ISS 


KYO 
PRESS 


sys 
5 HIGH 


ENABLE CURRENT POSITION 


низа xs xs xs XX .XX$ ^ 


xs s 


XX .XX$ 
XX.Xx$ 

С XX.Xx$ 
XX .XX$ 


A 

в 
низа хз xs a xs 

в 


Stimuct 
ENABLE 
RIGHT TURN 
(ЕРТ TURN 
STOP 


(+) 
(v) 


3х5 
3х5 


RIGHT 
IB XXXS XXXS XXXS XXXS 
OB XXXS XXXS XXXS XXXS 
NG XXXS XXXS XXXS XXXS 


(A) NWS CHECK 


ХХХХ/921/ 
ILI 


XX X 0D00/MM:M 
DOO /HHM:MM: 


ХХХХ/034/ ORBIT тат XX х оро/ни:м 
111113 

avy Avi 5 

ахх.у ®ХХ.Х sXXX.X 


PRED МАТСН« XXXXXXX 


1$ 
STAT ХХХХ 
ТЕМР хх 
stev 21x 
OPER 4х 
LII TX 


MNYR 119 
XX X XXX /XX:XX : XX 


фух 
ъХХХ.Х 
REF STAR 13X 
іш 14 X 


TYPE 1% XXXXXX 


CONTROLS 
її T? TO T! 
ЕЕ КЕ: ЕК: КЕ XXXX 
кїї зїї COMPUTE T! 
1533 . xx COMPUTE T2 
ыххх . хх 
ххх. xx 
ЮХХХ . xx 
lxxx. xx 
ХХХ. хх 


Exec 16Х 
ТЕЯМ 17 
ace 
1 2 
X ах.ХХ «ххх ! 
У аХ.ХХ OX. XK 2 
Z аХ.ХХ ах ХХ 3 


IMU BITE MASK 
13324 24x 
ХХХХ 25X 
(133 328121 


ANG 
1 
ХХХ.ХХ 
ХХХ.ХХ 
ХХХ.ХХ 
АХ aXXX.XX 
AY 2XXX.XX 
AZ эххх. хх 


МАУ АУ THRESH 
1% 13531313 


MM REAO 19Х 


(В) IMU ALIGN 


ХХХХ/ХХХ/108 XX X 000/MW:MM:5$ 


0D00/MH:MM:$89 


MANUAL CONTROLS 


anc я , Y 
*XXX XXX аххх t 
аХХХ аххх аххх 
XXX ХХХ *XXX 
ХХХ *ХХХ аххх 
SXXX еххх «ххх 
ЗХХХ эххх &ххх 
ЗХХХ XXX «XXX 
“ХХХ еххх аххх 
ХХХ еххх аххх 


ахх 
ахх 
sxx 
эхх 


BOY FLP 
t 


Y 
x 
x 
x A 
x 


э ж ж ж мж м м ж 2 
«x MMMM X09 


(C) MANUAL CONTROLS 


XX X DDD/HH:MM:$8 
ооо /HM:MM:$S8S 


%011/ 1 MASS MEMORY R/W 

54 СОМ BUFF ххх 

DESIREO ACTUAL 
Хх: — XXXX 
хххх хххх 
хххх хххх 
хххх хххх 
хххх хххх 
ХХХХ хххх 
хххх XXXX 
хххх хххх 
хххх XXXX 
ХХХХ XXXX 
ХХХХ XXXX 
Xxxx Xxxx 
ХХХХ хххх 
ХХХХ XXXX 
хххх хххх 
XXXX XXXX 
хххх хххх 
Xxxx хххх 
хххх хххх 
хххх хххх 


OESIREO 
xxix 
XXXX 
хххх 
хххх 
хххх 
хххх 
XXXX 
хххх 
XXXX 
хххх 
ХХХ 
хххх 
хххх 
хххх 
XXXX 
XXXX 
XXXX 
XXXX 
хххх 

CHECKSUM 


ACTUAL 
хххх 
хххх 
хххх 
хххх 
хххх 
XxXxX 
XXXX 
XXXX 
XXXX 
хххх 
ХХХХ 
XxXxX 
хххх 
XXXx 
XXXX 


SELECT 


PATCH 10 

VIOLATE 
REAO LOAD BLK 48x 
MERGE 40x 
WRITE LOAD BLK 60x 
COMPARE six 
STATUS хххх 
XXXX ERROR CODE ы 
Xxxx REGISTER A хххх 
ХХХХ в хххх 
хххх мм VERSION хх. хх 
ХХХХ DUMP VIA OL $2х 


(D) MASS MEMORY R/W 


[51547 73773 
аххх. 
(21332533 
1133 28 хх 
щххх. хх 
BASE TIME ХЕК/КК: КК: ХК 


ORBITER STATE 
ХХ/ХХ:ХХ:ХХ.ХХХ 
ЯХХХХХ . ХХХ 
AXXXXX. ХХХ 
*ХХХХХ.ХХХ 
&XX.XXXXXX 
&XX.XXXXXX 
RXX.XXXXXX 


(B) ORBIT TGT 


ХХХХ/051/ 


АВОЯТ МООЕ 
TAL 1х 
АТО 2x 

ABORT зх 

ТНАОТ МАХ 4Х 

АВТ SOX 


E£LEVON 
AUTO 7X 
FIXED 18x 


imu 
PRPLT DUMP 
ХХХ ICNCT 5 XXXX 
Ooms DUMP 
ARM ex 
ЗТАЯТ 7X ET 
STOP ax 
9 QUAM/$IDE 
OMS DUMP TTG 


25x 
26x 
27x 


$ЕР 
AVTO 
ЗЕР 


OVERRIDE 


SSME REPOS 
DES АТТ AA 


XX X 000/HM:MM:S8$ 

BFS 000/HHM:MM':S$ 

ENTRY FCS 
FILTER 
NOM 20x 
ALT 21!X 
19 XXX 


ATMOSPHERE 
ном 22x 
N POLE 23x 
$ POLE 24x 


RGA 
oes 
ssx 
30x 
37x 
30x 


SURF 
oes 
39x 
40x 
41x 
42x 


oes 
31x 
32x 
зэх 
34x 
26x 
29x ROLL MODE 
WRAP MODE 45 ХХХ 


ET ums DR 


АЕТ RCS 13 
14 ТІМЕ 


014056 


VENT DOOR CNTL 


FWO ACS 15 
16 TINE 


OPEN 
CLOSE 


30x comm 
TORS 
STON-MI 
$TON-LO 


sets 


хххх 
46х 
47Х 
40x 
2121 


43X XX 
44X XX 


(C) OVERRIDE (BFS) 


ХХХХ/061/ 


ABORT MODE 
TAL 
АТО 
АВОЯТ 
THROT МАХ 
АВТ 


ELEVON 
AUTO 17x 
FIXED 


t 
ххх !СнсСТ 
ом оош? 

АЋМ ex 
START 7X 
stor ex 

9 QUAN/SIOE 
OMS OUMP TTG 


$ хххх 


AFT ACS 13 
14 TIME 
01086 

FWO RCS 15 
16 TIME 


OVERRIDE 


ЕТ ums OA 


RCS ЯМ МАМЕ 
CL OVRO 41 


XX X 000/нНн:мм:8% 

D5D/HH:MM:$3 

ENTRY РСЗ 
FILTER 
NOM гөх 
ALT 21х 


ATMOSPHERE 
NOM 22х 
Н POLE 23X 
8 POLE 24Х 


XXXXXX 

XXXXXX 

XXXXXX 
х 


£XX.X 
£XX.X 
£XX.X 
Ц x 2 


ROLL МООЕ ХХХХХХХ 


зах 
зэх 


AUTO SEL 42% 
WRAP MODE 45 XXX 
VENT 0008 CNTL 
OPEN 43X XX 
CLOSE 44x XX 


40x 


(D) OVERRIDE (PASS) 
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ХХХХ/982/ 
Зм сом BUFF XXX 
PCMMU 088 Caweiss 
BITE WORD ХХХХ 20 ххх 
кит 21 TEST XXXX 
SEL FXO 1х8 
ғам 2х8 
РОМ 10 64 ххх 
128 ХХХ 
$ SEL 10 Кик 
LOAD 4 ХХХХ 


PCMMU/PL COMM XX 


110 RESET 


РСМ sxx 


110 RESET % CHANNEL. (ххх 
PSP1 GXX 2 CHANNEL XXXS 
PSP? 7ХХ PHASE LOCK XXXS 1 
sync BiT ххх ERR aXX$ 
FRAME XXXS ХМІТ РИЯ  XX.XXS 1 
LOAD ХХХХ ХХХХ PL SIG STR X.XXS 


X 000/HH:MM:$$ 
D00D/HHM:MM:S$ 
PD! 
110 RESET 8XX 
BITE WORD XXXX$ 
$ SEL DECOM 1 
10 SEL Fur Xxx 
LOAD 11 ХХХХ 
12 SEL INPUT К 
LOAD 13 
DECOM INPUT ҒЫТ 
1 x xxs 
2 x xxs 
з х xxs 
4 x xxs 
$ -ЕРЫ ххх 
DECOM ENA ЕНА 
FDA 1 14X 3 16X 
è 18K 4 17x 
8 TFL GPC SEL X 
DOWNLIST 
$ SEL РМТ 10 XX 


(А) PCMMU/PL COMM 


ХХХХ/094/ PORS CONTROL xx 
RMS SEL: XXXX RMS PWR XXX 
PORT 1Х 34 RMS S/N XXX SOF 
5180 2х 119 он $X AUT 
$ PL 10 її OFF 6x Pos 
4 ENO EFF X тон 
AUTO MODES 
1 2 3 4 
19 XX 14 XX 1$ хх 16 хх 


ОРА СМО MODES / POR Я 
Ено POS END АТТ 24 PL IN 
X ЫХХКХ.ХХ 2! P р.х 

221 Y Ыххх.хх смо CK 1 

23 R B]XXX.XX 


X DDO/MM:MM:88 
DOD/MM:MM:$8$ 
ENA INN- 

T STOP 7X эх 
© BRAKE ox 10x 
ENC CK 11X 12X 
8 СМТ 26X 29x 


17 START PT XXX 
LAST PT XXX 


EF 
IT 10 її 


POR OIS PLAY 39 


088 
WORM FL 
эх 


28 WR RA 
AUTO BRA 


XXXX/XXX/096 PORS FAULTS xx 


CHOMETER 
TOTAL COMPENSATOR 
MICROCOMPUTER 

MOA DEMAND VOLTAGE 
A/D CONVERTER 
BRAKE 


POS ENCODER 
BACKUP RELAY 


IVE BITE 
POS ENCODER 


хххх хххххххххх 
хххх жххххххххх 
хххх хжххххххххх 
хххх хжххххххххх 


(С) PDRS FAULTS 


ХХХХ/095/ХХХ PORS OVERRIDE xx 
XXXXXXXXXXXXXXXX 
MODE SW OVRD 1х 
1но | мт SW OVARO 
JOINT 
$H Yaw 
SH PITCH 
EL PITCH 
WR PITCH 
WR Yaw 
WR ROLL 
ЕЕ TEMP 


AUTO 3 зох CRIT TEMP 


AUTO 4 11x 
TEST 12x 
ENTER 13 


ж ж ж ж ж м ж ж А м DE 


MCIU OVERRIDE 
SAFING САМ 35K 
AGE OVRD A 36K 
АВЕ OVRD 8 37x 
ABE OVRD С зах 


LOADED RATE 14x 

STOWED OPS 15Х 

Simson Sw 
REASSIGN 16x 


(D) PDRS OVERRIDE 
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to смо 
Y*CAMR 
зах 


NOE x 
КЕ CK 27x 


X DOO/HH1!MM:SS 
DOD/HH1MMISS 


MCPC X 


хххх хххххххххх 


ххххххххе 


X ооо/нн:мм: 
оро/нн: мы : 


RATE SW OVRD 
VERNIER 
COARSE 


AUTO SW OVRO 
PROCEED 
$TOP 


НС AXIS CHG 
THe 
RHC 


XXXX/XXX/ 169 XX х DDO/HHIMMISS 


O00/HH1t MM: 

RMS SEL# XXXX = 

POR REF SEL1 XXX LAST PT XXX 
РОН5 ERR Х.Х АТТ ERR X.XXX 


PORS STATUS 


e = = + . 

+ххх.х5 £XXX.X5 £XXX.XS 
£XXXX. XS £XXXX.XS £XXXX.XS 
£XXX.XS £XXX.XS £XXX.XS 


£X.XXXS £X.XXXS 
£X.XXX 2X XXX *X.XXX 


ROT RATES ACT ёХ.ХХХ5 £X.XXXS £X.XXXS 
СМО =х.ххх #х.ххх 2X.XXX 


Ti 


POHS POS REF 
POHS ATT REF 
POSITION 
ATTITUOE 


TRANS RATES АСТ  £X.XXXS 
смо 


ЕХХХ.ХХ5  £XXX.XXS  £XXX.XXS 
МР WY 


x x x 
DERIG OPEN EXTEND 
&XXX.XXS ФХХХ.ХХ5  £XXX.XXS x х х 


(XX) 


(A) PDRS STATUS 


20211 1 PL ВАУ 00088 
AC POWER 1х 
2х PBO SW-XXXXS$ 
AUTO МОСЕ SEL эх MICRO-SW STAT 
LATS 00088 
АН | ОР/СК| AUTO] CCOO CARRO 
CENTER LATCHES [SEL $£Q| АВАВ ABC 
6° 0 xxs хххх 
9.12 Xx$ XXXX 
1-4 xxs XXXX 
13-14 xxs хххх 


XX X DO00/HM:MM:8$ 
DDO/HM:MM:8$ 


8180 
РИО LATCHES xxs XXXX 
АРТ LATCHES xxs хххх 
DOOR xxxs 

POAT 
FWO LATCHES xxs хххх 
AFT LATCHES xxs хххх 
оооп ххх 


ОРЕН 15Х 
STOP 16X 
CLOSE 17% 


PEO SW BYPASS 


PL RETENTION XX X DOD/HHIMMISS 


DOD/HH1MM1ISS 


хх хх 
хх хх хх 
XX/XX ххихх XX/XX 4 


(С) PL RETENTION 


XXXX/XXX/179 POWER TRANSFER хх X DDD/HHIMMISS 
1 > 


FC РОМЕН (KW) 
MAIN VOLTS 
PTU/MAIN BUS 


оғсу А 
OUT VOLTS хх.хх5 
AMPS 


TEMP 
TRIP 


(D) POWER TRANSFER 


XXXX/XXX/089 PRPLT THERMAL XX X DOO/HHIMM:SS 
онь ТЄ DOD/HH:MM1SS 


OMS CRSFO L R 


ЁО c 
ENG I/F ОХ XXX8 XFO OX XXXS XXXS XXXS 
DRN 


L LN XXXS XXXS 
OX XXXS XXXS 


TEST НЕ/ОХ 
2x 


(A) PRPLT THERMAL 


Хххх/о?э!/ acs XX X 000/НН:8м:58 
000/HM:MM.58 
X| 4 PRE Рас tim үнээ 
x AFT «мт ex|ouseRCS ory 
xisi AUT MAME CL xxx|rwo «exirwo 47х49 ХХ, XX5 
Off TX SOR XX 555 
JET; РАТЬ OES | лет | РТУ 48 PRESS ХХХ 


ххх | зех | 39x JET RESET 4% 


(B) RCS 


XXXx i102! 808/80Х/АОТА TEST XX X DDD/MMW:MM: 
DDO /MM:MM:8S8 
RCS DRIVERS 


(11:11 1х START TEST 4X STAT ХХХХ 
ПЈОА -А 2X сонт 6Х JET ххх 
“8 3х TERM 6 STEP x 


SENSORS TEST CONTROL 
HIGH START 15Х 
ЕМА STAT P LOW START 16x 
TX XXXX +ХХ.Х жХХ. AUTO SEQ 17x 
OX XXXX аХХ.Х8 aXX. TERM 16x 
OX ХХХХ aXX. 2XX.XS ахх. 
10X ХХХХ £XX.X8 аХхХ.Х5 ахх. INH ALL 19x 


“ENA STAT ғас РЗ ғай Pat TT 
11X ХХХХ XX, XXX8. XX, XXXS XX, XXX8. XX.XXX8. XXX.XX8 
12X XXXX ХХ.ХХХ8 ХХ.ХХХ8 ХХ.ХХХ8 ХХ.ХХХ8 XXX.XX$ 
TSK ХХХХ ХХ.ХХХ8 ХХ.ХХХ$ ХХ. ХХХ ХХ.ХХХ5 ХХХ.ХХ8 
14X ХХХХ XX. XXX8- ХХ.ХХХ8 XX,XXX8. XX.XXX8. ххх. хх8 


(С) RCS/RGA/ADTA TEST 


ХХХХ/033/ REL МАУ XX X DOO/HH: mu: 
АНОЕ МАУ ЕМА IX SV UPDATE ооогнн : мм: 
KU АНТ ENA 2X POS ХХ.ХХ X 
MEAS ENA 3X VEL XX.XX oF 
НАУ STAT P te 
SV SEL 4 XXXX RR хххх ХХХХ XXXXX 
Яна ХХХХ.ХХХ RNG  XXXX.XXX8 ХХХХ XXXXX 
аХХХХ.ХХ А *ХХХХ.ХХ® ХХХХ XXXXX 
XXX.XX EL «ХХХ XS 
аХХ.ХХ АТ «ххх .х8 MINUS PROP 
«ХХХ oP .хх.х Хх хх 
iXX хх. хх 
FILTER TO PROP х 


$ так 12Х RR 13K COAS 14K TO FLIR 8X 
STAT ХХХХХХХХХ  ХХХХ X x.x TO 707 10x 
FLTR UPOATE 15 XXX Y x.x TO ОАВ 11x 
COVAR REINIT 16X 

RESIO RATIO ACPT ЕЈ 
“ар £XX.XX x ХХХ xxs 


*ХХ.ХХ .X Ххх xxs 
VIELSY  aX.XX .X XXX xxs 
H/AZIX aX Xx x ххх xxs 
GPS X sXXX.XX xs 

X аххх.хх X8 


(D) REL NAV 
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ХХХХ/041/ ЯВАГ/АОТА/ЯС8 XX X DOD/MM:MM:88 
500 /HH:MM:$$ 
OES STAT я , М 
ХХХХ £XX.X$ axx.xs *хх.х$ 
ХХХХ аХхХх.х5 эхх. хз ёхх . ХЗ 
ХХХХ 4ХХ.Х9 аХХ.Х8 ахх.х% 
ХХХХ *XX.X8 ахх.х3 *хх.х% 


STAT [4] Pec Pou Pat T 

хххх -XXXS ХХ.ХХХ6 XX.XXX8 ХХ.ХХХ8 XXX .Xx8$ 
хххх -XXXS ХХ.ХХХ8 XX.XXX8 XX.XXXS XXX .Xx8 
хххх -XXXS ХХ.ХХХ8 XX.XXX8. ХХ.ХХХ8 ХХХ.хх5 
хххх .ХХХ8 ХХ.ХХХЗ XX.XXXS. ХХ.ХХХ5 ХХХ.ХХ5 


мІ 9х Low 10x STOP !1X 


ACS DRIVERS 


RIOF 12х TEST EXEC 19X TEST XXXX 
RJOA*A 13K CONTINUE 16Х JET ххх 
“8 14Х STOP 17 


(A) RGA/ADTA/RCS (ON-ORBIT) 


XXXxx 1/8281 RM ORBIT XX X 000/ИН:мм:55 


000/HM:MM:$8 


(B) RM ORBIT 


RTLS ТАА) 2 XX X DO0D/MH:MM:$8 
BFS 00D/MM:MM;$$9 


EER, РЕНЕА ЕНА сна 


со Pos 


х.хх 
g xx GUIO XXXX 
H хххх PRA 1X 
ТМЕСО XX:XX 
PRPLT xx 
ххх ххх 


(С) RTLS TRAJ 2 (BFS) 


RTLS TRAJ 2 XX X DOO/HH:M 
DO0D/MM:M 


ж їл Жян 


хххх 
XXXX AGORT XXXXXXXXXX TOO XX:XX 
SEO XXXXXX 
2K ARM 260 ХХХХХХ XXXXXXXXXX GUID XXXX 
4X ABORT 


5 ХХХ YAW STEER 


@x SERC хх 


THROT XXX 
PRPLT ХХ 


TMECO XX:XX 


, ХХХХХХХХХ ХХХХХ 


ХХХХХХХХХ XXXXX 


(FAULT MESSAGE LINE) 
(SCRATCH PAD LINE) 


(D) RTLS TRAJ 2 (PASS) 
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XX X OOD/H XXXX 109407 SENSOR TEST 
(11:11: : 

$ так CNTL ag 5 TABLE 1 2 ANG az et 
SELF-TEST 2х ТАК 10 ххх ххх wis 1 ХХ.Х8 їХ.ХХ$ Х.ХХ8 
STAR ТАК 4х в Мін ххх ххх 2 ХХ.Х8 1Х.ХХ$ Х.хх$ 
101 ТАК бх ANG OIF ХХХ.Х XXX.X . 3 ХХ.Х8 ах.ХХ8 X.XX$ 
BREAK ТАК L] ERA XX.XX XX.XX 

TERM/IOLE 10x Set 17x 18x ANG az 

$ TABLE CLR 20 X.X8 ХХХ.хх8 

Х,х$ ХХХ.ХХЗ 
X.X8 ХХХ.ХХ5 


ХХХХ/922/ $ TAK/COAS СИТЕ 


XX X 000/HH:M 
D00/HH:MM: 


$ TRK -Y СОА% 
ПЕСО 10 1% XIX REOD 10 
TRK 10 ххх &0EG х . ALT 
$ PRES x у ХХХХ$ 
AANG ах XX SIGHT MODE ХХХХӨ 
THOLO 13 x ACCEPT 
SHUTTER хх CAL MODE Y 
МАМ OP 15X ! oes ахх.х8 axx. 
STATUS ХХХХХХХХХ XXXXXXXXX ахх.х$ ахх, 
хххх хххх *ХХ.Х$ axx. 
*fXX.X8.— ахх. 


ox 26x 
А5 xxx 
UPDATE 28 


START 13x STOP 


(A) S TRK/COAS CNTL (A) SENSOR TEST (ON-ORBIT, 3 TACAN) 


ХХХХ/111/ 
$M COM BUFF XXX 


ХХХХ/101/ SENSOR SELF-TEST хх X ооо/ин SL MEMORY DUMP 


D0D/MM: 


XX X 000/MM: :8 
22225815 


ENA STAT ANG az eL ЗЕ COMP SEL 
1X XXXX ХХ.Х8 аХ.ХХ8 Х.ххў 4 1x 
2X XXXX ХХ.Х$ ах.ХХ$ Х.хх8 exp 2x 
3X XXXX хх.х$ ах.ХХ8 х.ххз SL COUPLER 


19443 
6 LENGTH XXill 


DUMP ? XXXX 


TEST CONTROL: 
START 

AUTO SEQ 
TERM WORDS ACQ ХХХХХ 
FAIL RHW XxXxX 
INH ALL 16x AW XXXXX 


LAST AOD XXXX 


(B) SENSOR SELF-TEST (3 GPS) (B) SL MEMORY DUMP 


ХХХХ/101/ SENSOR SELF-TEST XX X DOO/KH 


(11313113 


ХХХХ/0864/ SM GROUND CHECKOUT XX X DDD/HH:MM:$8 
D0D/HMM:MM:SS 


XXXXXXXXXXXXXXXX 


ENA STAT LII] АТ? Et 
1х XXXX XX.Xx$ &X.XX$ X.XX$ 
2X XXXX ХХ.Х5 &X.XX8 X.XX$ 
SX XXXX ХХ Х$ %Х.ХХ8 Х.ХХ$ 


EMA STAT RNO А? 
ах XXXX Х.Х$ ХХХ.ХХ8 
5Х хххх Х.Х5 XXX.XX8 
6X ХХХХ Х.Х$ ХХХ.ХХ5 


TEST CONTROL: 
START 
AUTO SEQ 
EMA STAT ALT TERU 
TX XXXX XXXX8 
OX XXXX XXXX$ INH ALL 16x 
ENA Y 
эх хх хз 
10x £XX.X8 
1x axx xs 
axXx xs 


(C) SENSOR SELF-TEST (3 TACANS) 


ХХХХ/040/ SENSOR TEST XX X ооогин 
111113 
! STAT ANG А? “ 
wis 1 XXXX XX.x$ зх.хх$ X.XX8 
2 ХХХХ ХХ.Х$ АХ.ХХ5 Хх.ххз 


з ХХХХ ХХ.Х$ 4Х.ХХ8 х.хх5 


ALT 


132211 
хххх $ 


v 
ахх,х3 sxx. 
ахх.х5 axx. 
аХХ.Х5 ахх. 
£XX.X8 ахх. 


START !3X $ ТОР 


(р) SENSOR TEST (ON-ORBIT, 3 GPS) 
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ENA INK 


FOA 2х 
PL ANNUM 4х 
SM ANNUM 5х 


DOWMLIST 
$ SEL тит її 
LOAD 7X 


RM$ TOOLS 

SOFT STOP/REACH 
TURNAROUND ax 
REINSTALL 9х 
SINGULARITY 10Х 
JOINT 

RATE LIMIT 11X 
12 JOINT SEL X 


18 ATTEM LIM XX 


PROCESS INH/ENA 


эх INH 


x $ P OP 
х 


15 X 


OPS ACTIVATE 1X 


(C) SM GROUND CHECKOUT 


ХХХХ/ХХХ/ 178 


ACTIVE DEVICES 
РОТ 


XX X DDO/HHIMM:SS 
DOD/HHt1MMI!SS 


SSOR 
PRI FRM_SYNC XXXS 
PRI STATUS XXXS 
B/U FRM_SYNC XXXS 
ВИО STATUS XXXS 


(D) SM OIU 


ХХХХ/ХХХ(/078 5м SYS SUMM | хх X 000/НН:8м:58 
BFS 000/НМ:3м:53 


SMOKE "ЈА 2/8 Joc VOLTS 31A 218 aic 


CABIN хх. хз (13 XX.X8 XX.X$ ХХ.Х3 
L/R FO ХХ,Х8 ХХ. XS MAIN XX.X8 XX.X8 XX.X8$ 
AV BAY 1 XX.X8 XX.xXx8 ess ХХ.Х5 XX.X8 ХХ.Х8 


2 .Х8 ХХ,Х8 А в с А 
3 ХХ.Х5 ХХ. XS CNTL 1 XXX,XSXXX.X8XXX.X8X 

2 XXX .XSXXX .XSXXX.X$X 
3 XXX ,XSXXX.XSXXX.X$X 


PRESS XX .Xx8 


49141 &.XX8 AC 
BU/EQ a.XX$ a.XXS VOLT ФА ХХХ$ Ххх$ xxxs 
PPO? X.XX8 Х.ХХ5 (13 XXXS XXXS XXXS 


FAN АР X,XX$ 
HX OUT T XXXS 
02 FLOW Х.Х8. х.х% 
N2 FLOW Х.Х Х.Х8 


ec XXXS ХХХ5 XXXS 

AMPS ФА ХХ.Х5 ХХ.Х5 ХХ.Х5 
eB ХХ.х% XX.X8 XX.x8 

ФС ХХ.Х5 XX.X$ XX.X8 

FUEL CELL PH XXS xxs xxs 
àv FC! FO? FOS AMPS ХХХ5 ХХХ XXXS 


$81 XXXS XXXS XXXS REAC VLV xxs xxs хх5 
$82 XXXS XXXS XXXS STACK Т aXXXS XXXS аххх5 
SSS XXXS XXXS XXXS EXIT T XXXS ХХХ xxxs 
TOTAL AMPS XXXXS coor P XXXS XXXS XXXS 


ки xxs PUMP xxs xxs хх 


(А) SM SYS SUMM 1 (BFS) 


XX х DOO/HHIMMISS 
000. 


гљ 17A 3 
XX.XS F ХХ.Х5 XX.XS хх.х5 
ХХ.Х5 XX.XS ХХ.Х5 ХХ.Х5 ХХ.Х5 
.XS XX.XS ХХ.Х5 ХХ,Х5 ХХ.Х5 
e XX.XS хх.х5 eC А 
XXX . XSXXX . XSXXX . XSX 
XXX . XSXXX . XSXXX , XSX 
XXX . XSXXX . XSXXX . XSK 


ХХХ5 XXXS XXXS 


T XXX 
O2 FLOW XX.XS XX.XS ХХ.Х5 ХХ.Х5 ХХ.Х5 
мг FLOW XX.XS XX.XS ФС ХХ.Х5 ХХ.Х5 ХХ.Х5 
& XXXS ХХХ5 ххх5 
551 ХХХ5 ХХХ5 ХХХ5 хх хх ХХ 
552 XXXS XXXS XXXS *XXXS £XXXS 4XXXS 
553 XXXS ХХХ5 ХХХ5 XXXS XXXS XXXS 
TOTAL AMPS XXXXS ХХХ5 XXXS XXXS 
KW хх ХХ5 хх5 OS 


ХХХХ/ХХХ/079 $M 575 SUMM 2 XX X оо0/ни:М 
BFS DOD/MN 
CRYO TK ! г 3 4 5 МАН 
на PRESS XXXS XXXS XXXS XXXS XXXS XXXS 
OF PRESS XXXXS XXXX8 XXXX$ XXXXS ХХХХ8 ХХХХВ 
HTA T! *ХХХ$ 2XXX8 XXXS XXXS XXXS 
12 xxs 
APU 1 HYO 1 1 
TEMP ЕСТ XXXXS XXXXS$ PRESS ХХХХ8 ХХХХЗ 
B/U ЕСТ ХХХХ$ KXXXS ACUM P ХХХХ$ XXXX$ 
ott ін xxxs xxxs ASYR T xxxs xxxs 
OUT xxxs XXX$ 
99 BED (131 XXXS QTY XXX$ ххх 
INJ ХХХХ$ XXXX$ 
SPEED « XXXS xxxs wit 
FUEL QTY xxxs xxx H20 QTY ххх5 xxxs 
xxs xxs BYP VLV XXXS ххх 
xxxs xxxs 


ххх xxxs THERM CNTL 4 

ХХХЗ xxxs H20 PUMP Р 13313 
FREON FLOW XXXX$ 
EVAP OUT T xxxs 


XXXX/XXx/079 SM SYS SUMM 2 хх X DOD/HHIMMISS 
DOD/Hd1!MM:SS 


CRYO TK 1 г 3 4 МАМЕ 1 МАМҒ2 
PRESS ХХХ5 ХХХ5 ХХХ5 ХХХ5 ХХХ5 E 


APU 1 
ТЕМР ЕбТ ХХХХ5 ХХХХ5 ХХХХ5 
B/U EGT хххх5 хххх5 XXXXS|RSVR 
OIL ім XXXS 5 Ххх5 Р 
OUT XXXS XXXS 
XXXS 


SPEED ж XXXS 
FUEL QTY XXXS 
PMP LK P XXS BYP VLV XXXS 
OIL OUT P XXXS 


THERM CNTL 
AV BAY нго PUMP Р 
ТЄМР XXXS FREON FLOW 
FAN АР — X.XXS ЕУАР OUT Т 


2223 
нго QTY XXXS 


(D) SM SYS SUMM 2 (PASS) 
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SM COM BUFF ххх 000/HM:MM: 
PARAM XXXXXX 
1 10 хїїїїїї 
VALUES GIXXXXXXXXS 
Limits 
ALERT BACKUP Caw 
Low н! Low н! 
ЇХӨЦХХҮХҮҮХ 3 Рики. XXI 'XbIXXXIXXXX 12 BIXXLLL.XLX 
4ХИХХХХХХХХ 5 ВИХХХХ.ХХ 
ӨХӨХХХХХХХХ 7 ыххххх хх 
è FILTER XX 18 FILTER XX 
эх ЕМА 14X 
INH 10X INH 15X 


CONSTANT 
16 10 їїїїїїї 
17 VALUE= GIXXXILLLIXILIILK 
СНЕСКРТ XXX/XX:XX:XX FOA 
INITIATE 18 ENA зэх 
STATUS XXXX XXXX INH 20x 


(A) SM TABLE MAINT 


XXXX 10441 SWITCHES XX X DDD/HH:MM:$5S 


D0D/HM:MM:$6 


ENTRY ROLL MODE 


9 ACO XXX 


(В) SWITCHES 


ХХХХ/042/ SWITCH/SURF XX X 000/МН:3м:55 
OOO /MH:MM:$$ 


(C) SWITCH/SURF 


ХХХХ/105/ TCS CONTROL XX X DDD/MM:MM:SS 
D00 /HH:MM:SS$ 
1 SELECT 10 11 NAME XXXXXXXX ECP ERROR XXX 


MM READ 2 XXXX STATUS хххх ERROR CODE XXX 


ster XXXXX TIME XX: XX :XX site Xxxx 
STOP з 4 STOP АТ XXXIX CANCEL 5 

RESUME 6 7 ASM АТ їїїїї CLEAR MSGS 4 

Time ТЕХТ 

XX: XX: XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX:XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX :XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX :XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX: XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
ХХ: ХХ: ХХ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
ХХ: ХХ : ХХ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX:XX:XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX : XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
XX: XX : ХХ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
хх: ХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХ 
ХХ: : ХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХХ 
хх:х XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 
хх: KXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 


XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 


(D) TCS CONTROL 
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coos Џ THERMAL XX X DDO/HH- 

BFS DOD/MHM: 
t ов R їз 
2XXX$ аХХХ8 аххх5 «ххх 
аХХХ85 XXXS £XXXS ахххЗ 
BRAKE PRESS 


HYD SYS 1/9 


8021/ 


HYO SYS TEMP BOYFLP МО/$В 
PRIME 


$T8Y ! 


XXXXXXX 


XXXXS 


НТЯ ТЕМР g Н 
PRPLT XXXS XXXS 
РОО XXXS XXXS 
OMS CRSFD хххе 
ЕҮАР 
н! 
ТОР 


шебін 


HYD ВЕЯУНТЯ 

АРЫ 

GG/FU PMP НТА |53355 
TKIFU LN НТЯ 88385355 
PUMPIVLY 


TIRE PRESS 

но LEFT RIGHT 
18 XXXS XXXS XXXS ХХХЗ 
OB XXXS XXXS XXXS XXXS 

ххх XXX XXXS 


LOAD 
руст 
но: 


(А) THERMAL 


ХХХХ/00?/ XX X DDD/HH:MM:5$ 3051/ 
ооо,.нн:мм:$8$ 
MISSION TIME TONE 
быт ix 3 
МЕТ 2Х . 
СЯТ ТІМЕН 
9 SET [фїхї:її:її 
START 12 $TOP 13 
14 START AT IX:IL:XL MSH T 
17 COUNT TO XX:XX:XX MSN T 


XXXXXXX 
ХЕ: ЕЕ: ХЕ MSN T 
XX:XX:XX 


29 ЫЖї:Хїї:хї Сат T 


23 DURATION ХХ 


мито 
24 GMT А руху ХХ: ХҮ: ҮҮ ҮҮҮ 
28 MET А МХХХ/ХХ:ХХ:ХХ ХХХ 
ОРОАТЕ 32 МЕТ RESET 33 
ВРС Time арс 


амт Try хх 


MTU accum 1 
2 

з 

GPe 


TIME SYNC 38 


ХХХ/ХХ:ХХ:ХХ.ХХххХЗ 
ХХХЇХХ:ХХ:ХХ.ХХїХЗ 
ХХХЇХХ:ХХ:ХХ.ХХХ5 
ХХХ/ХХ:ХХ:ХХ.Ххх9 


34 
3% 
зв 
37 


хх 
хх 
хх 
хх 


Vert sit 


хх х 000/HM:MM: 
OOO/HH: ми: 


NOSE н! 
» 


570 ек 
смо 


ххх 
ххх 


нү 

NY TRIN 
AIL 

RUD 

TGT NZ 


X.XXX 
X.XXX 
хх.х 
хх.х 
х.х 


хх 


NOSE 10 


XXXXXXXX X XXX 


(A) VERT SIT 1 GRTLS 


VERT Sit 2 
315 255 


D00/HH:MM:SS 
000/HH:MM:8$8 


NOSE HI тёти 
4 
ххх ном 


ххх - 


НОВЕ LO Tut» 


(B) TIME (B) VERT SIT 2 (PASS/BFS) 


20117 П UNIV PIG XX X DOD/MH:MM:58S ТТІ VERT SIT 2 XX X 000/ИМ:3 


CUR MNVR COMPL XX:XX:XX 
START TIME XIXI/XX:X1X:XX 
CUR FUT 


DDD/HM:MM:S$ 


CUR FUT XXXXXXX 


(ин 
272 обоин м 


OPTION START MNVR 18 X X 8851 25 X 


x 


1922494 
XXX.XX 
XXX .XX 


TRK/ROT OPTIONS 
= тат 10 XIX 


TRK 19 X 
ROT 20 X 
сонор 21 


АТТ шон 
22 MON AXIS 
ERR TOT 23X 


X GNCL 26 
X DURAT!ON 27 
ЖЕ: ЕЕ: о 55 34 


E хх 


$ тм 


ВА NOSE ны 


otc 
LAT 
сон 
ALT 


тїї їїї 
(595444 
ых хх 
12:33 99334 
Birirri.r 


ERR ОАР 24Х 


4 


ROLL ном 


ХХХ.ХХ 
113513) ХХХ - ХХ 
ERR їХХХ.ХХ 
RATE sXX.XXX 


PITCH 

XXX.XX 

XXX.XX 
iXXX.XX 
£XX.XXX 


YAW 
XXX.XX 
XXX.XX 

aXXX .XX 
£XX.XXX 


ххх 
(113 ххх 


BODY УЕСТ К 235 B 
NOSE LO МЕР 
Р 5 5 5 33 
Y XXX.XX 


Om ххх хх 


(C) UNIV РТС 


39517 DDD/HM:MM- 


11211113 
DDO/MMH:MM: 


эх 
19Х 
11x 
12x 
13X 
14х 
15x 
16x 


MENU (1)XX X DOD/MH:MM:S$ 
D00/MHM:MM:$8 
STP/PURGE CYC СМТ XXXXX 
6 CODE ххх 
CODE СМТ  XXXX 
RIMSG ONT XXXX 
MSGS STILL IN LIST ххх 


1х 
2х 
sx 
4х 
sx 
вх 
7х 
зх 


ХХХХХХХ 


220 wcos BITE 
MODE 
838: 
8582 
swsw 


хххх 
хххх 
XXXX 
XXXX 


17 0 T 
NOSE и! EU FORMAT LOAD 


» START GPC SELF TEST 
STOP GPC SELF TEST 
START DEU SELF TEST 
STOP STP ON ERROR 
CONTINUE STP ON ERR 
INHIBIT СКРТ КОАО 


ххх 
ххх 


ХХХХХХХХХХХХХХ 


хх 


7 PT!ON 
NOSE 10 sibi ы 5 


START 
stor 


114 
20x 


(D) VERT SIT 1 (PASS/BFS) (D) XXXX IPL MENU (1) 
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10417 1 
омз вотн 1х 
L 2х8 
R 3х3 
RCS SEL 4х 
$ TV ROLL XXIX 
TRIM LOAD MNVR 27X ХХХХХ | VGO X зХХХХ.ХХ 
.? biat : Y Xxx. xx 
7 цу ых х 2 £XXX.XX 
8 RY Ых.х 
9? WT LLIIIX HA НР 
% 118 тет ххх +ХХХ 
15542443543 4254 CUR ххх £XXX 
PEG 4 
сї хїхїї 
с? ишү 
нт 13525553 
ет іі-іші 
PRPLT БДҮХЇїҮ 
РЕЗ 7 


XXXXX MNVR ҮҮҮҮҮ хх X рОр/МН:8М:33 
БЕ D0D/HH:UM:$8 

XXXX 
XXXX.X 


XX: xx 


BURN АТТ 
24 А ші 
25 P XXX 
28 Y XXX 


бүтот 
11:13 


PRI 24Х 
SEO 30x 
OFF sax 


35 ABORT TGT її 


FWO ACS 
ARN 
OUNP 37x 

AVX brrr. OFF 33x 
AVY Вик XXXXXXX SURF ORIVE 
ду: ШхіІ.І он sox 

XXXX 22/TIMER 23 ОРЕ 4ох 


зах 
GMBL CK 


(A) XXXXX MNVR YYYYY (PASS/BFS) 


XXXXXX TRAJ 1 X РОН : МЫ : 33 


хх 
BFS ОООГНН:МЫ : 35 


(В) ХХХХХХ TRAJ 1 (BFS) 


ХХХХХХ ТАА) 1 XX X 0DD/HH:M 83 


DOD/HH:MM:SS 


XXXXXXXXXXX 


CONT ABORT 
SEQ XXXXXX 
2X ARM 2ЕО XXXXXX 
4X ABORT 


XXXXXXXXXX 
XXXXXXXXXX 


XXXXX 
5 XXX YAW STEER 


THROT XXX 


7 XXX ОАР 1ЕО XXXXXXXXX XXXXX 
XXXXXXXXX XXXXX 
[FAULT MESSAGE LINE) 


(SCRATCH PAD LINE) 


(C) XXXXXX TRAJ 1 (PASS) 


XXXXXX TRAJ 2 ХХ X DDO/HH:MM:$53 


GFS DOO/HH:MM:S8S 


co 


T ххх 
ТМЕСО ХХ: ХХ 
ХХХ ХХХ 


(D) ХХХХХХ TRAJ 2 (ВЕБ) 
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XX X оро/нн:ми:55 
DDO/HH:MM:58 


гэг гч. 


хххх 
ХХХХХХХХХХ 


XXXXXX TRAJ 2 


CONT ABORT 

SEQ XXXXXX 

2X ARM 260 XXXXXX 
4X ABORT 


TGO XX:XX 


XXXXXXXXXX 


5 XXX YAW STEER 
8X SERC ХХ 


THROT ххх 
PRPLT XX 
ХХХХХХХХХ XXX 
XXXXXXXXXXXXX 


TMECO XX:XX 


7 XXX DRP ТЕО XXXXXXXXX 


XXXXXXXXX 


XXXXX 
XXXXX 


(FAULT MESSAGE LINE) 
(SCRATCH PAD LINE) 


(A) XXXXXX TRAJ 2 (PASS) 
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Notes Notes 
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APPENDIX C STUDY NOTES 


CONTENTS 


APU/HYD 
Comm-Voice Data 


Ascent/ Entry FCS 

GNC Sensors and Controllers 
Instrumentation 

Mechanical Systems 


This appendix contains a set of study notes 
originally developed by Ron Grabe in 
September 1989. They have been extensively 
modified and updated over the years and 
reviewed for technical content by the Training 
Division. 


The purpose of these notes is to provide 
crewmembers with a set of critical “need-to- 
know” items that can be reviewed in their 
entirety at one sitting. The notes are directed at 
the PLT crew position, but should be useful for 
other crewmembers as well. 


The Study Notes are organized alphabetically 
by major system. Under each system heading, 
notes on critical subsystems and malfunctions 
are presented. The text is written in Flight Data 
File shorthand using switch nomenclature and 
DPS display terminology, which results in a 
somewhat cryptic format. Although directed 
primarily toward Generic and Flight-Specific 
training, they should be readily understood by 
crewmembers who have progressed through at 
least part of Pilot Pool training. 


Preparation for Shuttle Mission Simulator 
(SMS) training sessions is difficult due to the 
complexity of the Space Shuttle and the many 
flight phases that crewmembers are required to 
understand. A quick review of these Study 
Notes prior to SMS sessions should help make 
training more productive. 
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APU/HYD 


General 


e Ascent: all APUs will be kept running 
through MECO if possible. 


— Loss of one APU means hydraulic lock 
on one engine. 


Loss of two APUs means two SSMEs in 
hydraulic lock plus loss of TVC for one 
SSME. 


e Entry 


Pre-TAEM, а sick APU (high ой 
temperature, high hydraulic tempera- 
ture, pump leak P, H,O leak) may be 
manually shut down, cooled down, and 
restarted near Mach 1 to support 
landing. 


Post-TAEM, APUs generally will be 
kept running except for high oil temp- 
erature. An APU will be shut down for 
high oil temperature if Mach >1. A 
gearbox failure for high oil temperature 
is not catastrophic. 


Auto Shutdown 


Controller will issue an auto shutdown 
command, if auto shutdown is enabled, for 
RPM less than 80% or above 129% (auto 
shutdown is inhibited for the first 10.5 
seconds after start to allow turbine spinup). 


Auto shutdown closes secondary fuel control 
valve and fuel tank valves. 


An APU with an underspeed shutdown is a 
candidate for cooldown and restart. 


APUs with confirmed overspeed shutdown 
will not be restarted. 


If auto shutdown inhibited and APU speed is 
confirmed above 129%, manual shutdown is 
required as soon as possible. 
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Single APU Loss 


Single APU loss will not affect nosewheel 
steering (hydraulic system 1 is prime and 
system 2 is backup). 


Single APU loss will not affect braking (loss 
of APU 3 plus either 1 or 2 means half 
brakes). 


Hyd system 1 is prime for main and nose 
gear deploy. If APU 1 is lost, the landing 
gear will be deployed with pyros. There is 
no hydraulic backup to main landing gear 
deploy, Hyd system 2 gives a hydraulic backup 
to nose gear deploy only. 


Switching Valves 
Supply either primary or one of two back-up 
hydraulic systems to the aerosurface 
actuators. 


Valve status only visible on SPEC 86 (SM 
OPS 2). 


During FCS checkout, check active hydraulic 
system selected. 


Fuel Tank 


Supply supports about 110 minutes of 
operations, enough for an AOA if the APUs 
are taken to low pressure post-MECO. 


Nitrogen pre-charge required for start-up. 


Different Hyd Pressure sensors are displayed 
on the MEDS meter and SM SYS SUM 2. 


Quantity (DPS display and MEDS meter) is a 
PVT calculation. 


Isolation valves must be closed (de-powered) 
when APU is not running. No fuel cooling of 
solenoid valves. 


— Post АРТ) shutdown, if fuel tank valve 
temperature high, pull circuit breakers. 


- Solenoid short may overtemp valves 
while APU is still running. Pull circuit 
breaker for second valve in parallel. 
Will keep APU running. 
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Fuel Pump 


Gear driven pump delivers fuel under 
pressure post start. 


“APU PUMP LK P” shows build-up of 
leaking oil or fuel in catch bottle. Bottle 
relieves overboard. 


Cooling 


GG bed injectors cooled by separate H,O 
injection system for re-start. H,O system not 
used during normal ops. 


Cooling required for 3.5 minutes in INJECTOR 
COOL prior to start. If no cooling of GG 
injector apparent, do not perform restart. 


If APU not started immediately following 
cool-down, injector temperature will rise 
again rapidly. 


Common tank for all APUs. 
capacity is 21 minutes. 


Total cooling 


Fuel pump and fuel control valves are cooled 
passively by heat sinks and radiation shields. 


Water spray boiler cools hydraulic and lube oil. 


- Bypass valve isolates hydraulic cooling 
feature when not required. 


- Two controllers (A and B) use common 
water lines but have different spray 
logic. 


- Water quantity should not decrease 
during ascent. Pre-charge in H2O boiler 
immerses oil lines. No spraying until 
MET about 8:00. 


- PGME (an antifreeze) is present in the 


cooling water to prevent the WSBs from 
freezing. 


Hydraulic Accumulator 


® Maintains pressure of about 2600 psi when 


APU not running (hydraulic pressure still 
about 65 psi). 


e Prevents hydraulic pump cavitation. 


Low accumulator pressure оп orbit indicates 
nitrogen leak or internal priority valve or 
unloader valve failure. 


Circulation Pump 


Two-stage pump. First stage low pressure, 
high volume. Second stage high pressure, low 
volume. High pressure fluid can be diverted 
to repress accumulator. Otherwise, high 
pressure fluid mixes with low pressure fluid. 


On orbit, automatically turns on (when 
pressure « 1960 psi) to maintain accumulator 
pressure. 


Circ pumps keep hydraulic fluid moving for 
thermal conditioning on orbit. Automatically 
turn on for low hydraulic line temperatures. 


Only one circ pump operates at a time in 
GPC control for electrical loads considera- 
tions. The system with low accumulator 
pressure has higher priority than the system 
with low hydraulic line temperatures. For 
thermal reasons, two circ pumps at a time are 
OK if needed to recharge two accumulators. 


Priority Rate Limiting 


Software routine used to prevent over- 
demanding the available hydraulic systems 
in the event one or more systems fail. It 
ensures that the more important aerosurfaces 
(e.g., elevons, rudder) are given hydraulic 
pressure demand priority over the less 
important aerosurfaces (e.g., speed brake and 
body flap). 


Gets 3 hydraulic pressure inputs from each 
system. 


Crew can see 2 of the inputs on BFS SYS 
SUMM and MEDS meter. MCC has access to 
all three inputs. 


Crew can also see hydraulic accumulator 
pressure that PRL does not see. 


- Use hydraulic accumulator pressure 
and RPM to resolve dilemma. 


- Accumulator pressure - 3000 means 


hydraulic system OK. 
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PRL will show down arrow if declaring 
system down. 


SPEC 51 data: 
- AUT* means auto logic is active. 


- DES* means manual deselection (toggle 
to reselect). 


For PRL ^?" and system good, leave auto 
logic selected. 


— Subsequent transducer fail may require 
deselect of auto logic and a manual 
deselect or reselect. 


For PRL down arrow and system good, 
deselect auto logic to reinstate hydraulic 
system into PRL. 


Manual Shutdown 
Used to back up auto shutdown. 


Controller power off protects 
uncommanded hot re-start. 


against 


Must identify over or underspeed shutdown 
prior to controller power off (caution and 
warning light extinguished). 


Ready-To-Start Talkback Gray 
Low press selected. 
Н:О spray boiler ready. 
APU fuel isolation valves open. 
GG bed temperature >190 degrees. 
APU speed below 80%. 


Underspeed immediately after start is 
probably caused by 10.5-second timer failure. 
Auto shutdown is normally disabled during 
first 10.5 seconds of start. AUTO SHUT- 
DOWN to INHIBIT may allow start. 
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Comm-Voice Data 


General 


e PANEL/CMD on panel C3 switch passes 
S-band control to system selected on aft 
panel. One step total reconfiguration to 
alternate system. 


® Normally, INCO manages system on LRU by 
LRU basis. All LRUs are system 1/system 2 
redundant. 


ACCU 


e Routes all audio to ATUs. 
е No voice (ICOM and A/G), switch ACCUs. 


e CDR and PLT can talk to each other on same 
ATU without an ACCU. 


Antenna Electronics Unit 


e Switches antenna рег GPC ог RTC command. 
е BFS commands for ascent and entry. 
е SM GPC command on orbit. 


® Commands routed to antenna electronics 1/2 
over PL MDM 1/2, respectively. No cross- 
strapping capability. 


e Manual selection available with loss of auto 
select. 


Ascent/Entry Configuration 
e S-band system 2 active in STDN mode. 
- STDN sites prime for comm. 
- On orbit, 1 to 2 hour call up. 
е A/G1 and A/G 2 selected simo. 
е І/НЕТ/К оп А/А loop. 
е TDRS available on ascent and ТАТ. 


— On ascent, a stored program command 
will mode to TDRS at L/O + 7:30. 
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- Crew can manually reconfigure the comm 
system via switches on panel A1L and/or 
by item entries on BFS G51. 


Encryptor, Transponder, and Power Amp 


e Power amp and preamp are not used if 
configured for STDN low mode. 


e Encryption is normally on uplink only. 


- Encryptor dedicated to one NSP. Not 
selectable separately. 


- Bypass selected for encryption failure. 


NSP 


e Processes uplink and downlink (voice, 
commands, and data), except UHF that 
bypasses NSP. 


e Failure means no S-band voice, commands or 
data to/from ground. 


“BCE STRG X NSP” where X = active FF 
MDM (1 or 3). Could be just command 
failed. Check data/voice with MCC. 


Cryo 


General 


e Separate transducers for DPS display and 
overhead meters. 


® DPS display data goes off scale low for big 
leaks. 


Heaters 
e Each tank has A and B heaters. 
e Separate controls/logic for Огапа FH» heaters. 


® О» heaters have two elements with two 
current sensors per heater. 


* Crew insight into sensor status in ОР52 only. 


e If any current sensor trips (short), that heater 
is disabled. 


* Heater logic (applies separately to O» and 
Нә). 


- Both tanks іп а ganged pair must have 
low P before heaters in either tank are 
turned on. 


- Only one high Р is needed to turn both 
heaters off. 


- During leak isolation, pressure in good 
tank may prevent heaters in leaking tank 
from coming on with both tanks’ heaters 
enabled. 


— Control points for heaters: 


Но tank 1 and 2 pressure = 203 to 223 
O» tank 1 and 2 pressure - 811 to 846 


- Tank 3, 4, and 5 set points slightly higher 
so tank 3, 4, and 5 will preferentially feed 
on orbit with all tanks in AUTO. 


Leaks 


First step in ascent and entry cryo leak 
procedure is to determine number of tanks 
with pressure decreasing. 


- Only one tank leaking, leave configura- 
tion as is (manifold isolation valves 
open). Leak is a tank leak. Isolating tank 
will starve its fuel cell. 


- Ш all tanks decreasing, close manifold 
valves to isolate leak. Must react quickly 
for large multi-tank leaks. 


— If leak internal to fuel cell 3, need to 
reopen manifold valves ASAP. Manifold 
3 does not have a relief valve. 


DPS 


General 


e It is important to be able to identify GPC 


failures, for MCC often has little insight. 
Crew information affects MCC analysis and 
planning for subsequent failures (both DPS 
and non DPS). 


When using the GPC MODE switch, remove 
your hand between positions. On past mis- 
sions, there have been problems with the 
switch being in two positions at the same time. 
This problem can occur on other orbiter 
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switches also. It is good practice to always 
pause slightly in each switch detent to ensure 
the contacts are made and recognized by the 
GPCs. 


Always clear the fault message line as soon 
as messages have been seen. This will avoid 
missing annunciations of subsequent 
failures. 


Resume SPECs and DISPs from IDPs when 
not in use or prior to switching to another 
major function on that IDP. 


Hard assign IDPs (both PASS and BFS) via 
PASS IDP keyboard (BFS will DK listen). 
Dual DPS display commanders сап ђе 
caused by trying to assign an IDP to BFS that 
a PASS GPC is still driving. 


When moding PASS GPCs into the common 
set (ie, STBY to RUN), always pause 10 
seconds before making further switch throws 
or item entries to avoid possible fail-to-sync 
and ensure proper common set initialization. 


BFS Engage 


Post BFS engage, check to ensure that all 
active PASS GPCs have recognized the 
engage (both MODE and OUTPUT talkbacks 
are barberpole). If not, take the offending 
GPC to HALT (or power it off) immediately 
to avoid I/O problems on the flight-critical 
strings. 


Restringing 
Deassign IDPs to avoid inadvertent entries. 


Before OPS transitions and restrings, verify 
the NBAT. Check proper MAJOR FUNC- 
TION and GPC switch configuration. 


Ensure the correct memory configuration is 
displayed prior to making NBAT changes. 


Dynamic flight. 


— Use the Restring сие card. 


Take the failed GPC to HALT (or STBY, 
HALT) prior to OPS MODE RECALL. 
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Deselect surface feedbacks prior to OPS 
MODE RECALL. Reselect following OPS 
MODE RECALL. 


Follow OPS MODE RECALL with BFS 
I/O RESET (or PRO to OPS 3 if TAL). 


Avoid assignment of all three IDPs to the 
same GPC, especially on orbit. 


Keep hands off of everything during OPS 
transitions, especially switches and IDP 
keyboards. 


Rules. 


Always to critical 


capability. 


restring regain 


Powered flight. In general, you can 
recover stuck throttle if necessary for 
uphill performance. 


Post MECO, pre ET SEP. Recover jets 
required for SEP. 


Pre OMS-1. Recover single OMS ignition 
capability (delay burn). Regain critical 
system insight (if engagable BFS still 
available). Maintain single fault tolerance. 


Entry. Regain vent door commands. 
Regain nose wheel steering for abort 
landing site or known directional control 
problems during rollout. Maintain ASA 
command and body flap command. 


In general, port moding is preferred over 
restring to regain lost capability. 


Prior to EI-5, restring for any failed GPC. 


Set Split 


е 2o0n2or2o0n1o0n1 split during ascent 


- Engage BFS. 


If desired, the PASS set сап be 
reconfigured pre-MECO if BFS is tracking 
and no additional complicating failures 
are present, rather than engaging the BFS. 
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Treat simplex machines or undesired 
set as failed GPCs. Work the GPC fail 
procedure twice sequentially. 


BFS engage required on ascent for 
MPS commands if simplex machines 
or undesired set cannot be taken to 
HALT pre-MECO. 


Restring may be performed with MCC 
coordination, in accordance with 
Flight Rules. 


Be prepared for BFS engage if sets 
begin force fight or total set split. 


BFS engage decisions for set splits. 


On seeing multiple GPC fault and CAM 
lights, call "SET SPLIT". 


Check BFS and PASS GNC SYS SUMM. 


If BFS tracking 2 PASS GPCs, check them 
for 1 IMU, 2 FCS channels, 1 RGA, and 1 
AA. (Minimum for good PASS set.) 


If BFS standalone, check PASS if time 
permits. Time available is based on NAV 
state without IMU data: 


Powered flight - =10 seconds 
Entry - =45 seconds 
Orbit - plenty of time 


Distribute IDPs among different GPCs. On 
orbit, ensure all IDPs are not assigned to the 
SM GPC or a single GNC OPS GPC. Loss of 
the GPC with all IDPs loses PASS DPS 
display interface. 


ECLSS 


General 


During ascent, only Freon pumps will be 
swapped if lost, and then only to avoid RTLS or 
TAL. All other fans and pumps are cooling 
equipment that can wait until post-MECO. 


All ECLSS data seen on the overhead meters 
(panel O1) come from the same sensors as 
seen on the DPS displays. 


e МН. Boiler А(В) control based оп 
temperature іп Freon loop 1(2). 


- If no flow in Freon loop, must use NH3 
boiler corresponding to good loop. 


— If degraded flow in Freon loop, select 
NH; boiler for loop with degraded flow. 


— Control to the good loop but not the dead loop. 


Cabin Pressure 


e First reaction to cabin leak is to close cabin 
relief isolation valves one at a time. 


e Double check leak indications with MCC. 
May be due to cabin expansion or thermal 
effects such as seen during First Stage. 


e М/О» leak into cabin will cause rise in cabin 
pressure and for О» leak, PPO» will also rise 
(О; concentration available on orbit). 


e dP/dt on meter and DPS display come from 
dP/dt sensor. 


e EQ dP/dt is calculated from cabin pressure 
and dP/dt sensors by BFS and standardized to 
a 14.7 psi cabin. EQ dP/dt is used when 
available to make ascent abort decisions for 
cabin leak. Backup dP/dt is also calculated 
from cabin pressure, but not standardized for 
а 14.7 cabin. 


EPS 


General 


е Do not reset popped circuit protection device 
(RPC or circuit breaker) without consulting 
MCC. 


e For critical actions, MCC may call for 
momentary reset of failed control or essential 
bus while crew holds switch for affected 
system in desired position (“three finger 
trick”). 


AC Bus 


e Surge on AC bus can cause main engine 
controller to trip off line. Avoid actuation or 
switching of AC powered equipment during 
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powered flight unless called for in 
malfunction procedures or by MCC. 


— Loads that can be switched in powered 
flight: 


Avionics bay fans (only for 3-phase 
motor stop) 

Freon pumps (only to help determine 
if RTLS or TAL is required) 

Н:О loops (only for Evap Out T Low) 


AC bus sensors OFF on ascent to protect 
SSMES for: 


— Loss of first engine. 


- Loss of SSME controller redundancy on 
any engine. 


- Loss of a single AC phase (takes down ап 
SSME controller on two engines). 


— When AC bus sensors are OFF, no hard- 
ware caution and warning lights will 
illuminate (no AC VOLTS or AC 
OVERLOAD light). 


AC voltage high 


— Ride until MECO unless volts exceed 130, 
or affected main engine controllers are 
lost (MCC call). 


- Trip bus off line with AUTO TRIP 
selection on bus sensor. 


AC phase shift (three-phase motors stop) 


— Verified by normal volts and multi-phase 
amps possibly slightly high. 


— Multiple three-phase motors fall off line: 
fuel cell pump, Freon pump, H,O pump, 
AC bay fans, etc. 


— Take individual phases off line separately 
to find bad phase. 


If AC bus sensor in AUTO TRIP, AC phase 
will be automatically disconnected for either 
an AC overload or high AC volts. 
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If AC bus sensor in MONITOR, will get 
hardware caution and warning, but will not 
get AUTO TRIP feature. 


AC bus sensor uses different transducer than 
one feeding F9 meter or DPS display. 


AC bus sensor needs to see rapid rise or delta 
amps to issue an AC OVERLOAD indication. 


Bus Tie Actions 


If re-establishing power to a main bus (main 
bus volts < 20), always unpower the AC 
inverters before tying to a good bus (prevents 
surges). Use long form bus tie procedure on 
cue card. 


If a tie results in a short, immediately untie. 


Never tie 3 main buses during powered 
flight. OK post-MECO, on orbit, and entry. 


Never tie into a short. 


Payload primary bus can be used to tie Main 
B to Main C (back door bus tie), or connect 
FC3 to Main C. 


Do not bus tie in first stage for the first fuel cell 
problem. 


Fuel Cell 


Coolant pump and H2 pump both driven by 
same AC bus and both pumps controlled by 
fuel cell ECU and START/STOP switch. 


Coolant pump draws 0.5 amps, H» pump 
draws 0.3 amps. 


Coolant pump delta P indication. 


- Ground can see immediately if loss of fuel 
cell coolant pump is real (stop/start to 
check run current not required). 


- No comm, can stop fuel cell and check for 
0.8 amp drop. This indicates both pumps 
were running (bad sensor). Restart gives 
full recovery (should see 0.8 amp 
increase). 


START switch sends pump start commands. 
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— Pressure should be sensed in 3 seconds. 
Delta P talkback goes gray. 


- READY FOR LOAD talkback requires 30 
second timer and good heaters. 


- Delta P relay failure may prevent fuel cell 
ECU from latching on fuel cell start 
command. DELTA P talkback won't stay 
gray. ОК to hold START switch in 
START. After 30 seconds, second relay 
should latch command on (can release 
START switch). 


Coolant pump failure stagnates coolant loop. 


— Stack T measured downstream of the stack 
outlet. Will slowly decrease after coolant 
pump failure. 


— Exit T measured in H?/ H20 loop. 


- If H» pump running, exit T will 
progressively increase after coolant pump 
failure. 


— Nine minutes of run time available after 
first coolant pump failure, assuming 
normal fuel loading. 


О» is entirely consumed. Н» is circulated 
continuously through power section and 
condenser. 


- НО is drawn out of stack by mixing with 
Нь, 


- Н2О is separated at the Н›/Н›0 pump. 


- Dual gas regulator maintains proper 
pressure of reactants (about 60 psia). О» 
pressure feeds coolant loop accumulator. 


- Dual gas regulator problem indicated by 
COOL P HIGH/LOW. Tie buses and 
monitor fuel cell for degradation. 


— If О» reactant valve closes, coolant 
pressure will drop. 


Failure of the H2/H2O pump will lead to fuel 
cell flooding since water is not removed. 


— Ascent and entry: pH status fail followed 
by slow degrade and exit temperature 
decreasing may be first signatures of 
flooding. 


- Indicated on orbit by Н» pump status fail. 
Crossover (uncontrolled Oz and H2 mixing). 


- Highly unlikely to happen 
without warning signs. 


rapidly 

- Fuel cell delta volts increasing is a 
warning. 

- PHhigh may occur, but not necessarily. 

- Fuel cell degradation will eventually occur. 


Separate pH sensor for each fuel cell and 
common sensor in H2O manifold. 


- pHfail may indicate pending breakdown 
of Fuel Cell matrix (fuel cell crossover). 
Potential explosive mixing of H2 and О». 


- High fuel cell delta volts 


confirming cue. 


provides 


— Assume matrix failure for pH fail and bus 
tie as soon as possible. Problem may be 
an H2/ H2O pump failure. 


- Common pHsensor сап confirm 
individual fuel cell sensor. Will annunci- 
ate about 10 minutes after individual fuel 
cell pH (common pH only seen by crew 
on orbit). 


In normal configuration, redundantly 
powered loads are load shared (also known 
as dioded loads). 


- Hotrunning fuel cell (real STACK T high) 
will grab more than its share of the load. 
Indication is high amps. 


- Flooding (real EXIT T low) will cause fuel 
cell to shed load. 


Water output of all fuel cells feeds common 
manifold. 


- Water expulsion for fuel cell is 
preferentially: Tank A (primary), Tank B 
(alternate), Dumped overboard (relief). 


- FC Н›0 LINE НТК controls heaters on 
each fuel cell primary and alternate path. 


C-9 


USA007587 
Rev. A 


— FC RELIEF LINE HTR controls heaters on 
each fuel cell relief line. 


— Each fuel cell relief line merges into one 
common manifold that vents H:O 
overboard. 


e Purge process pumps extra О» and H2 


through fuel cell. 
— Removes contaminants. 


— Excess O2 апа Н» dumped overboard. АП 
three fuel cell purge lines merge into one 
О» and опе Нь» manifold. 


- Purge only one fuel cell at a time. 


Nominal load is 7 kw per fuel cell. For 
powerdown operations, 13 kw OK on one 
fuel cell for 4 hours, 12 kW OK continuously. 


Main Bus Short 


Fuel cell will overheat in time. Amps high, 
fuel cell and main volts low. 


— Short before the fuel cell main bus switch 
will have high amps and will not drop 
when fuel cell is isolated from main bus. 
Fuel cell and main volts will remain low. 
Should be treated like a fuel cell short. 


— Fuel cell internal short. Amps low, fuel 
cell and main volts low. 


- Fuel cell inadvertent disconnect. Amps 
low (should be zero), fuel cell volts 
greater than 32, main volts near zero. OK 
to attempt reconnect. 


Ascent/Entry FCS 


FCS Channels 
Each FCS channel includes: 
- One GPC 
— One FA MDM 
- Two black boxes (ASA and ATVC) 
— Sixteen servovalves 


One solenoid set for body flap 
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e Always maintain at least two good FCS — Switch actuation can result in momentary 
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channels and one good position feedback for 
each aerosurface. 


"Port bypass” means a servovalve's isolation 


loss of channel. 


АБА/ АТУС Internal Power Fail: 


valve (which is spring-loaded closed) is - Results in all affected ports being 
commanded open. This allows hydraulic bypassed. 
fluid to flow freely past the servovalve, - For ASAs, results in zero voltage 


making it ineffective. 
FCS Channel Switches: 


Assumes ASA switches (panels O14, O15, 
O16) and ATVC switches (panel O17) are 
ON. 


OVERRIDE: 


- Supplies internal power to ASA and 
ATVC. 


— Resets all ports on affected channel 
(unless manually bypassed - aerosurface 
ports only). 


- Inhibits port bypass due to high SEC AP 
on affected channel. (Can still bypass due 
to internal power fail or from manual 


bypass.) 
AUTO: 


— Supplies internal power to ASA and 
ATVC. 


- Allows ports to bypass due to high 
SEC AP. 


OFF: 


— Interrupts internal power to ASA and 
ATVC. 


— Bypasses all ports on channel (due to loss 
of internal power fail). 


feedback being sent to GPCs. (Feedback 
needs to be deselected, either manually or 
by FDIR.) 


No action required for single port bypass 
with no other failures. 


For two failures on the same actuator, take 
remaining good channels to OVERRIDE. 
Prevents a good channel from bypassing 
(thus leaving only a bad channel) in the event 
of a subsequent 1-on-1 force fight. 


MCC may call to manually bypass a port (via 
SPEC 53) if the port does not bypass on its 
own or to prevent the port from resetting if 
the affected FCS channel is subsequently 
taken to OVERRIDE. 


Position Feedbacks 


Each aerosurface position feedback is 
measured by four transducers (one per FCS 
channel). SRB/SSME position feedback does 
not use transducers, but rather is built into 
the servovalve hardware. 


Aerosurface feedbacks go to FDIR and 
selection filter to determine aerosurface 
position for GPC computations. 


FDIR: 
— Each aerosurface has its own FDIR. 


- FDIR compares feedbacks against I-load 


tolerances. If a feedback exceeds 
— For ASAs, causes zero voltage feedback to tolerances, FDIR will declare that 
go to FDIR/selection filter. feedback invalid. 


Pause 2 seconds between all FCS channel 
switch position changes. 


— Switches are break-before-make. 
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- FDIR quits after first "failure" (їе, 
manual or auto deselection, commfault). 


— FDIR will return if all failures removed 
(i.e, feedbacks аге reselected ог if 
commfíaults are cleared). 


e Selection Filter (excluding body Нар): 


— Selection filter schemes: 
3 valid inputs MVS 


2 valid inputs Average 
1 valid input Pass Thru 
0 valid inputs Last Value 


- Initially uses inputs across FCS channels 
1, 2, and 3. Channel 4 is held in reserve. 


- If an input is declared invalid (either by 
FDIR or by being manually deselected), 
input from channel 4 is used in its place. 


— Selection filter will downmode if a 
feedback 15 either deselected ог 
commfaulted. 


— Selection filter will upmode if a feedback 
is reselected or if the commfault is 
removed. 


BFS RM Differences: 


- BFS has no FDIR. Crew must manually 
deselect bad feedbacks. 


— BFS selection filter uses ап IMVS scheme 
(1.е., uses feedbacks on all four channels). 


- BFS selection filter downmodes/upmodes 
due to crew input only. 


The ASAs combine position feedbacks and 
GPC position commands to create position 
error commands, which go toward moving 
the servovalves. 


A bad feedback can cause the affected 
servovalve to force fight the others. If 
SEC AP exceeds limits, the affected port will 
bypass. At the same time, if the feedback 
itself exceeds tolerances, it will be declared 
invalid by FDIR. 


Feedback deselection on SPEC 53 deselects 
all feedbacks on channel and terminates 
FDIR on all aerosurfaces. 
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Any OFF channel should have feedbacks 
deselected. If channel is recovered, reselect 
feedback after channel is taken to AUTO. 


Body Flap Differences 


Body flap commanding goes across FCS 
channels 1, 2, and 3 only. 


Body flap feedback goes across all four FCS 
channels. 


The APUs are hard assigned to the body flap 
channels. An APU failure also means a lost 
body flap channel. 


Body flap channels use solenoids instead of 
servovalves, so there are no ports to bypass. 


Body flap feedback goes through a QMVS 
selection filter. 


GPC/MDM Impacts to FCS Channels 


GPC/MDM failures commfault port statuses. 
Take affected FCS channel to OFF. This 
causes all affected ports to bypass and avoids 
possible force fights. 


GPC/MDM failures commfault position 
feedbacks. Deselect affected feedback. This 
prevents GPCs from using a potentially bad 
feedback if I/O is later restored. 


After a restring, and one GPC has control 
over two FCS channels, one channel is taken 
to OFF, so that the GPC’s control authority is 
equal to that of the other GPCs. 


BCE STRG X “D” failure will commfault 
feedback on affected FCS channel, but 
commanding across the affected FCS channel 
remains good. 
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GNC Sensors and Controllers - BFS selection filter downmodes/upmodes 


APPENDIX C: STUDY NOTES 


AAs and RGAs 


AAs and RGAs go through an FDIR and 
selection filter to determine values used for 
GPC computations. 


FDIR: 


- FDIR compares АА and RGA values 
against I-load tolerances. If a value 
exceeds tolerances, FDIR will declare that 
AA or RGA invalid. 


— FDIR quits after first failure (i.e., manual 
or auto deselection, commfault). 


— FDIR will return if all failures removed 
(ie, АА ог RGA is reselected or if the 
commfault is cleared). 


- RGAs have an additional SMRD (spin 
motor run detector) FDIR, which protects 
against RGA power failures. SMRD quits 
after the third deselection. 


Selection Filter: 


— Selection filter schemes: 
4 valid inputs IMVS 
3 valid inputs MVS 


2 valid inputs Average 
1 valid input Pass Thru 
0 valid inputs Last Value 


— Selection filter will downmode if an AA 
or RGA і either deselected or 
commfaulted. 


- Selection filter will upmode if the AA or 
RGA is reselected or if the commfault is 
removed. 


BFS RM Differences: 


— BFS has no FDIR. Crew must manually 
deselect failed AAs and RGAs. 


— BFS selection filter also uses an IMVS 
scheme. 
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due to crew input only. 


IMU 
SPEC 21 shows IMU status. 


— OFF, BITE, blank in status field. 


- Mode designated by *: STBY (caged) or 
OPER (operate) 


GPC send operate command through FF 
MDMs. 


— IMU returns status (operate discrete) over 
FF MDM card A. 


- IMU returns digital data over FF MDM 
serial I/O card 


- STBY and power off conditions available 
on SPEC 21 after “BCE STRG X IMU”, but 
not after FF MDM lost. 


GPC or FF MDM port failure. 


— IMU will maintain operate command. 
Commands and output of MDMs are 
latched at last value. 


— IMU will operate without pulse torquing 
compensation. Should maintain reason- 
able align for several hours. 


FF power cycle. 


- IMUs can maintain OPER CMD LATCH 
for approximately 8 seconds. 


FF power fail. 


— IMU loses operate command and goes to 
STBY (upon recovery of I/O). 


— InSTBY, IMU spins down and cages. 


- FF 1,2,3 power failure signature (follow- 
ing “I/O ERROR FF X”) is loss of SSME 
Pc tape (ascent). Deselect IMU PASS and 
BFS after FF power fail (IMU will come 
back caged when I/O regained). PASS 
will automatically deselect a commfaulted 
IMU in OPS 3. 


BCE STRG IMU. 


Could be result of IMU losing power. 
SPEC 21 (orbit and entry only) shows 
IMU status OFF, mode STBY. An IMU 
BITE/T message annunciated at the same 
time is also a confirming cue for the IMU 
power fail. 


Could be loss of IMU data to the FF MDM 
(serial I/O card down). Status and data 
blank on SPEC 21. Mode will still show 
operate, received over card A. 


Standby mode. 


If IMU has moded to STBY, it will begin 
startup sequencing once the operate 
discrete is restored. 


Transient power fail, causes startup 
sequence which cages IMU (approxi- 
mately 90 seconds). 


When IMU completes startup sequence 
(caged), it will mode to operate and be 
available to selection filter upon an I/O 
reset. Hence, any caged IMU should be 
deselected (PASS and BFS), if not already. 


PASS selection filter. 


Any IMU not commfaulted (M) or 
deselected is a candidate. 


An IMU in 5ТВУ is not a candidate. 
Attitude selection is MVS at 3 level. 


Downmode ог upmode to 2 level. 
Maintain previously selected if available. 
Otherwise lowest numbered IMU. 


Velocity is MVS at 3 level (component 
basis). Averaged at 2 level. 


PASS RM. 


Either attitude or velocity fail removes 
IMU from selection filter. 


PASS will not RM fail an IMU for a BITE 
(H/W or S/W) at 3 level. 
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— IMU with BITE will fail RM if dilemma at 
2 level. 


— If IMU miscompare at 2 level and PASS 
sees no BITE, IMU dilemma declared. 
Manual deselection required to break 
dilemma. Use MCC or deselect IMU. 
BFS is prime selecting to break tie. 


BFS RM and selection. 


- Only commfaults, power loss, hardware 
BITE, and manual deselect will remove an 
IMU from candidacy. 


— Selection is MVS at 3 level. 


— Once downmoded to 2 level, BFS will 
only upmode to 3 level if taken through 
OPS 0 and up to OPS 3. 


— Selection on downmode to 2 level is 
lowest numbered IMU. 


— At 2 level, BFS can be taken off lowest 
numbered IMU with deselect followed by 
reselect. 


— BFS uses first deselected, last reselected 
logic after MVS broken. 


— IMU deselected for H/W BITE will not be 
upmoded if other IMUs lost. 


IMU dilemma. 


— If MCC comm available, ask MCC which 
IMU to deselect (PASS and BFS). 


- Nocomm, deselect lowest numbered IMU 
in PASS. BFS will use lowest numbered. 


— Let NAV run to determine which IMU is 
better. 


Navaids 


For TACAN and ADTA management, talk to 
MCC before incorporating. Without commu- 
nication, use the NO COMM TACAN MGMT 
and ADTA MGMT cue card. 
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RHC/THC/SBTC/RPTA 


е Availability 
- RHC 


L,R RHC: АПОР5 


A RHC: 
- THC 
L THC: 


- LRRPTA: 


OPS 2, 8 


OPS 1 (post MECO) 
OPS 2, 8 
OPS 3 (ММ 301-303) 
OPS 2, 8 


ОР5 3 (ММ 304-305) 
ОР5 6 (ММ 602-603) 
OPS 1 (ММ 102-103) 
OPS 3 (MM304-305) 
OPS 6 


OPS 3 (MM304-305) 


e FF MDM Channelization 


- RHC 


L КНС: 
R RHC: 
A КНС: 


- THC 


LTHC: 
A THC: 


- SBTC 


L SBTC: 
R SBTC: 


- RPTA 


L RPTA: 
RRPTA: 


e FDIR 


- FDIR compares channel inputs against 
I-loaded tolerances. If an input exceeds 
tolerances, FDIR will declare that channel 


invalid. 


For THC, FDIR performs 2/3 voting. 


For RHC, a failure in a single axis 
(pitch, yaw, roll) is enough for FDIR 


(roll) 


FFs 1, 2,3 
FFs 1, 2,3 


FFs 1, 2,3 
FFs 2, 3, 4 


FFs 1, 2,3 
FFs 2, 3, 4 


to declare the channel invalid. 


(pitch, yaw) 


For THC, each direction (+X, -X, +Y, 
-Y, +Z, -Z) has its own FDIR. A 
failure in one direction has no impact 
on the others. 


- After second failure (excluding comm- 


faults), FDIR will declare a dilemma. 
Controller is no-opted. 


For THC, dilemma affects only the 
one direction. THC still works in 
other directions. 


For a dilemma, the affected FLT 
СМТЕК PWR is turned OFF to protect 
against the next failure from clearing 
the dilemma but resulting in a bad 
input being processed. 


Selection Filter 


Selection filter schemes: 


3 valid inputs MVS (THC: 2/3 vote) 
2 valid inputs Ave (THC: 2/2 vote) 
1 valid input Pass Thru 

0 valid inputs Last Value 


Selection filter will downmode if a 
channel is manually deselected (via OPS 
2,8), declared invalid by FDIR, or 
commfaulted. 


Selection filter will upmode if a channel is 
either reselected (via OPS 2,8), the 
channel is no longer invalid, or the 
commfault is removed. 


BFS RM Differences 


Controllers not available during powered 
flight with BFS engaged. 


BFS does not process R RPTA, but right 
rudder pedals are mechanically linked 
to left rudder pedals. 

BFS has no FDIR. 

BFS Selection Filter is always MVS and 

cannot downmode. 


No manual deselection, and BFS does 
not recognize commfaults. 
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® Taking manual throttles (PLT only): 


— Mash and hold the takeover button. 


SPD BK/THROT light extinguishes for 
both CDR and PLT. 


- Match the current throttle setting to 
within 4%. 


MAN SPD  BK/THROT light 
illuminates for PLT only. 


“Throt” field on Ascent/Entry Flight 
Display shows “Man” апа is 
surrounded by a yellow box. 


— Release the takeover button. 


e Taking manual speedbrake: 


— Depress the takeover button. (No need to 
match current setting.) 


- SPD BK/THROT light: 


MAN light illuminates for SBTC in 
control. 


Light extinguished for SBTC not in 
control. 


- “SB” field оп Ascent/Entry Flight 
Display shows “Man” and is surrounded 
by a yellow box. 


e Manual attitude control: 


— Powered: All axes simo 


Both P and R/Y CSS lights illuminates 
for CDR and PLT. 


“DAP” field on Ascent Entry Flight 
Display shows “CSS” апа is 
surrounded by a yellow box. 


— Orbit: All axes simo 


INRTL light illuminates on ORB DAP 
panel. 


“DAP” field on Ascent/Entry Flight 
Display shows “шї” and is 
surrounded by a yellow box (if not BFS 
engaged). 
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- Glided: All axes simo, or Pitch only, or 
Roll/ Yaw only 


Appropriate CSS lights (P or R/Y) for 
both CDR and PLT illuminates. 


On Ascent/Entry Flight Display, “CSS” 
shows by the appropriate field (“Pitch” 
or “В/У”). Field is surrounded by a 
yellow box if M>1 and not BFS 
engaged. 


e “Hot Stick” Downmode 


- Not available during powered flight. 


- Occurs when RHC is deflected by more 
than 6°. 


- Triggers “DAP DNMODE RHC” fault 
message. 


e Aft Sense Switch (Panel A6) 


- Affects aft RHC and aft THC only. 


— Specifies whether RHC/THC commands 
are oriented to either the -X or -Z orbiter 
body axis. 


— Visual control reference based on line of 
site. 


Instrumentation 


General 


® OI MDM loss results in parameters showing 
Ms. 


• OI Dedicated Signal Conditioner (DSC) loss 
shows data on respective parameters as L. 


е Loss of ОГ MDM does not affect data to 
meters, but some digital data may be lost. 
DSC loss will affect most meters. 


e OI DSC loss section of REF DATA is accurate 
only for DSC parameters, not MDMs. 


Data 


e Runs through signal conditioners and/or 
MDMs 


— OI MDM data is sent to the PCMMU 
where the BFS and/or SM GPC can 
retrieve it. 
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- PCMMU swap reads alternate ports on OI 
MDMs. 


— GNC GPCs receive OI data from sensors 
and ОГ DSCs through flight-critical 
MDMs. 


Mechanical Systems 


General 


e ET doors and latches, vent doors, star tracker 
doors, air data probes, payload bay doors 
and latches, RMS latching gear, and payload 
retention latches are powered by dual AC 
motors linked through a differential. 


— One motor fail results in double actuation 
time. Actuation times are listed in the 
FDF. 


- Most actuators have dual microswitch 
pairs for open and close indications. 


e Failed mid-motor controllers or popped 
circuit breakers on MA73C are a frequent 
cause of payload bay door, ET door, or vent 
door single motor ops. 


Payload Bay Doors 


e PL BAY DOOR SYS ENABLE switches only 
enable payload bay doors. Other systems in 
payload bay use PAYLOAD BAY MECH 
POWER switches to allow operation. 


e “PBD CONFIG” message means а 
microswitch is indicating differently than 
required by software for auto operations. 
Can occur any time during auto open/close 
sequence. May require manual door 
operation. 


® “PBD SEQ FAIL” message caused by failure 
of proper microswitch indications within 
single motor actuation time. Can occur 
during auto sequence. 


e A Dilemma (727) results from the software 
seeing conflicting microswitch indications. 
Can occur during Auto or Manual sequence. 


When operating the doors in Manual mode, 
stay in Manual (do not go back to Auto) 
unless MCC or the procedures direct 
otherwise. 


ET Doors 


Close manually for uphill or AOA, 
automatically for RTLS (MM602) or TAL 
(ММ304). 


Always double check doors closed before 
AOA OPS 3 transition, or TAL flag set before 
late TAL OPS3 transition: software command 
on SPEC 51 is only available in MM104, 105, 
and 106. 


MPS 
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General 


The amount of propellant (PRPLT) in the ET 
is displayed, in percent, on the PASS 
ASCENT TRAJ 2 display. This value is 
calculated by PASS, not measured from the 
ET. 


The SSMEs at 104% throttles will consume 
about 4% propellant per engine per minute 
(i.e., 1% every 5 seconds with three engines 
running). 


Actual throttle setting in bucket will vary 
with SRB performance. 


“Cold” SRBs = shallow bucket 
- “Hot” SRBs = two-stage bucket 


Take manual throttles whenever CSS is 
taken. Manual throttles means manual 
MECO 

(3 pb simo at BFS cutoff cue). 


At fine count, engines are throttled back to 
protect for a low level cut: 67% (for three 
engines), 91% (for two or one engine). 


Engine Failure 


Indications of a failed engine: 


— Master alarm 


— Loss of acceleration 


- Fault messages: 
“SSME FAIL C(L,R)" 
“MPS H2 OUT P C(L,R)” -- BFS only 
“MPS O2 OUT T C(L,R)” -- BFS only 
— Helium dP/dt = 0 
— Pcmeter = 0 


- Red status light (no red light if data path 
failure exists) 


Ensure that the GPCs recognize failed engine 
(i.e, check for “SSME FAIL C(L,R)' fault 
message). If no message, use pushbutton to 
mode guidance and flight control, and to safe 
the SSME. 


Work SSME FAIL/SHUTDN procedure: 


— AC Bus Sensors - OFF. (Prevents the AC 
bus sensors from erroneously taking an 
AC bus offline, which would impact the 
engine controllers of the remaining 
engines.) 


- Check with MCC about reenabling SSME 
limits. (Limits on the remaining engines 
were automatically inhibited.) 


- If second SSME fail, the MPS 2% steps 
apply, unless MCC says otherwise: 


— At 2% prop remaining, manual throttle to 
6796, then manual MECO at BFS cutoff 
cue. 


Command Path Failure 


Command path failure created when the 
main engine controller does not receive two 
out of three valid inputs from the GPCs. 


GPC and electrical failures can impact 55МЕ 
commanding. Use MPS 2 cue card to 
evaluate. 


Command path failure may not annunciate 
until as late as 3-g throttling (when next 
command from СРС» is issued). 


Command path failures always require 
manual shutdown pre-MECO via AC/ pb. 
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Data Path Failure 


Data path failure created when GPCs lose 
both primary and secondary SSME data 
coming from the main engine controller. 


Must determine whether engine 18 still 
running. 


If SSME has failed: 


— Use the pushbutton to mode guidance 
and flight control, and to safe the SSME. 


— Work SSME FAIL/SHUTDN procedure. 
If SSME is still running: 


- Check with MCC about reenabling SSME 
limits. (Limits on the other two engines 
were automatically inhibited.) 


— Assume that the data path failure is also a 
command path failure, unless MCC 
explicitly says otherwise. 


Pc meter will be set to zero for engine with a 
data path failure. Also, red status light will 
not illuminate after engine shutdown. 


Hydraulic/Electric Lockup 


Hydraulic lockup caused when main engine 
controller sees that one of the five hydraulic 
valves in the SSME is not in the commanded 
position. 


Electric lockup caused when main engine 
controller loses either Pc or fuel flow rate 
data from the engine. 


Loss of an APU will eventually cause a 
hydraulic lockup. This may also cause a 
“MPS CMD C(L,R)” fault message post- 
MECO, during MPS dump. 


When having to choose between shutting 
down a hydraulic lockup and an electric 
lockup, preference is given to the hydraulic 
lockup (the “sicker” engine). 


e With two hydraulic systems failures, two 


engines are in hydraulic lockup. In addition, 
one of those two is also non-gimbaling. 
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Helium Leaks 


Non-isolatable leak requires interconnect at 
ТК Р < 1150 psi to extend run time. 


— Use pneumatic helium tank (i.e., leaking 
ENG He ICNCT - IN OP). 


— Use helium from any failed SSME (їе, 
failed ENG He ICNCT - OUT OP). 


- MCC may call for interconnect at a TK P 
other than 1150 psi. 


— Return all helium interconnect switches to 
GPC post ET SEP to support automatic 
МР5 dumping and inerting. 


Crew assumes that non-isolatable leak will 
not support zero-g shutdown at MECO. 


- Manual shutdown via  pushbutton 
required pre-MECO. (Requires less 
helium than a zero-g shutdown.) 


- MCC may say shutdown not required, 
depending on leak size. 


APC4(5,6) or ALC1(2,3) Failures: 


- For ALC failure, BFS GNC SYS SUMM 1 
shows the following: 


ULL P LH2 12.0) 
Lo2 0.0 


- For APC failure, along with the same 
ULL P indications for an ALC failure, 
there is also an “5М2 APU SPD LO 1(2,3)” 
fault message. 


- C(L,R) He ISOL A has failed closed. Do 
not attempt leak isolation steps. 


- Treat helium leaks on affected engine ав 
non-isolatable. 


Pneumatic accumulator leak requires steps to 
repress accumulator at 30 seconds before 
MECO. 


Manual Shutdown 


Manual shutdown cues of VI=23K (3-ENG), 
24.5K (2-ENG), and 22.5K (TAL) correspond 
roughly to 30 seconds before MECO. 
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Manual shutdown typically done ма 
pushbuttons. 


If pushbutton does not work, shutdown via 
AC/pb. (Creates a data path failure on that 
engine.) 


Shutdown with AC switches no-ops the MPS 
LO2 dump for affected 55МЕ. Manual LO2 
inerting may be required. 


SSME Pushbuttons 


Pushing the 55МЕ pushbutton generates two 
commands in the GPCs: 


- SHUTDN command - Initiates SSME 
shutdown 


— SAFING command - In the presence of a 
Data Path Failure, will set in motion three 
things: 


1. Modes Guidance 
2. Modes Hight Control 


3. Closes the prevalves 


Each pushbutton has two contacts. 
- Eachcontact powered by a CNTL bus. 


— Status of each contact carried to the GPCs 
via an FF MDM. 


- CNTL bus/FF MDM assignments are 
printed on panel C3 below each 
pushbutton. 


Pushbutton Conditions: 


Fully Operational - There are no failures: 


- Pushbutton will generate both SHUTDN 
command and SAFING command. 


Commfaulted - One (not both) of the contacts 
has an associated FF МОМ that is 
commfíaulted: 


- Pushbutton will only generate SAFING 
command. 


- Pushbutton will NOT generate SHUTDN 
command. Manual shutdown must be 
done via AC/ pb. 


- For BFS, а commfaulted pushbutton will 
NOT generate either command. (BFS 
does not recognize commfaults.) 


Broken - Either contact has an associated 
CNTL bus that is failed, or either contact is 
failed OP (i.e., some type of contamination): 


- Pushbutton will NOT generate either a 
SHUTDN command nor a SAFING 
command. 


— Pushbutton in dilemma when one contact 
reads OP and the other contact reads CL; 
“ME SHDN SW C(L, К)” fault message 
generated. 


Broken pushbutton can be used to generate 
SAFING command, given the following: 


— Affected contact is either fixed (CNTL bus 
is recovered or contamination clears). 


— Affected contact is commfaulted by 
power cycling the associated FF MDM. 
(Does not apply to BFS, because BFS does 
not recognize commfaults.) 


MECO CONFIRMED Flag 


The MECO CONFIRMED flag can be set by 
any of the following: 


- 3ЗРс'ѕ < 30% 
- 2Pc’s < 30% and a data path failure 


- 3 SAFING commands (ie. pressing all 
three SSME pushbuttons) 


- OPS 104 PRO (OPS 602 PRO will not set 
MECO CONFIRMED) 


— Fast ET sep 
Crew sees that MECO CONFIRMED is set 


when they see Orbit DAP lights turn on. 
(Orbit DAP lights not driven on RTLS.) 
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Status Lights / Pc Meters 


e Status Lights: 


- Amber = Stuck throttle (command path 
failure, hydraulic lockup, electric lockup) 
or data path failure 


- Red = Engine has shut down, or is 
violating redlines (if limits are inhibited) 


® MDMs assigned to status lights and Pc 


meters: 

— Center: ЕРІ 
— Left: FF2 
- Right: FF3 


Impacts from MDM failure: 


- MDM port failure: 
indication. 


Latches current 


- MDM power failure: Pc meter reads zero; 
status light goes off (or stays off). 


Entry 
MPS Helium Regulator Failure 


— Failure indications: 
SM Alert 


“MPS He P C(L,R)” message or “MPS 
PNEU REG” message 


MPS C&W light on F7 matrix (for Reg A 
failure only) 


- Use BFS GNC SYS SUMM 1 ог 
OMS/MPS MEDS display to identify 
failed reg, and close appropriate helium 
isol valve. 


- A helium regulator failed open before 
M=2.4 (ie. before the vent doors аге 
commanded open) could be catastrophic, 
due to ап overpressurized ай 
compartment. 


During RTLS, due to additional helium 
usage, MPS C&W light and fault messages 
might occur also for low He TK Ps and for 
low He REG Ps. 
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OMS - GN2 accumulator designed to preserve 
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General 


Nominally used for orbital transfers: 


- OMS2 burn 
— Rendezvous burns 


- Deorbit burn 
Supplemental uses: 


— OMS assist (flight specific) 


- Propellant source for aft RCS jets (via 
interconnect) 


Off-nominal uses: 


- OMS1 burn (in the event of severe ascent 
performance problems) 


— Ascent abort dumps 


OMS Subsystems 


Helium Tank 


- Provides pressurization to maintain 
propellant flow to the OMS engines. 


- For helium tank leaks, procedures set up 
an OMS burn to "max blowdown" in the 
propellant tanks (Qty ~ 39%) 


Propellant Tanks 


— Stores the propellants: 
OX = nitrogen tetroxide 
FU = monomethyl hydrazine 
- At one time, engineers considered 
providing for an OMS Kit (a 
supplemental set of propellant tanks), but 
this effort was later abandoned. 


- For propellant tank leaks, procedures set 
up an OMS burn to depletion, rather than 
let propellant accumulate іп ай 
compartment. 


Nitrogen Tank 


- Nitrogen used to open ball valves for the 
burn. Post burn, nitrogen used to purge 
fuel lines. 
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enough nitrogen for at least one OMS 
burn. 


— If the GN2 tank has failed but the GN2 
accumulator is still ^ adequately 
pressurized, the affected OMS engine is 
reserved for the deorbit burn. 

— With an GN2 accumulator leak, the ball 
valves cannot open once all the nitrogen 
has leaked out, resulting in an OMS ENG 
FAIL. 


Engine (OME) 


- Each engine provides about 6000 Ib of 
thrust. 


- OX flows straight into injector plate; 
FU first flows through cooling jacket 
before flowing into injector plate. 


- Hypergolic reaction between OX and FU 
in combustion chamber produces thrust. 


Gimbal Actuator 


— Two actuators per engine (pitch and 
yaw). 

— Two motors per actuator (PRI and SEC), 
powered through the APC subbuses. 


- FF MDMs carry the ENA commands. 
FA MDMs carry the position commands 
and position feedbacks. 

— Gimbals move to TRIM LOAD positions 
at TIG-15 sec (but only if the delta is 
greater than 0.42). 

- During OMS burns, ТУС DAP gimbals 
engines to keep the thrust vector pointed 
through the c.g. (i.e, nulls IMU-sensed 
rates). 

- Operationally, crew selects between PRI 
and SEC gimbals twice (to ensure ZAP 
command). 


OMS/RCS interfaces 
— OMS and RCS use the same OX and FU. 


- OMS propellant can be used in one of 
three ways: 
Straight feed  [i.e., L(R)OMS propellant 
through L(R)OMS engine] 


Crossfeed Їїе, L OMS propellant 
through R OMS engine, or vice 
versa] 


Interconnect [1е., (В) OMS propellant 
through Aft RCS jets] 


— Cannot interconnect КС5 propellant to 
OMS engine. (Could damage the RCS 
tanks.) 


— Cannot interconnect OMS to Fwd RCS. 


At one time, engineers considered 
providing for a Fwd RCS interconnect, 
but this effort was later abandoned. 


e Heaters 


— Collection of pod heaters, panel heaters, 
and line heaters, designed to prevent the 
propellants from freezing. 


- Two circuits: “A” (typically used during 
first half of mission) and “B” (typically 
used during second half). 

- Caution: Simultaneously running both 
“А” апа “В” OMS pods heaters will 
result in burnout of the heaters. 


OMS Quantity Gauging 


® OMS quantity determined via an electrical 


probe that runs along the central axis of the 
propellant tank. 


® Gauging only updates when at least one 


OMS engine is burning. Otherwise, quantity 
readings are static. 


e Totalizer integrator: 


- Functions during first 15 sec of OMS burn 
while propellant settles, after which 
quantities are taken from probe. 


- Functions for an accumulated 108 sec 
when propellant level is between 45% and 
30% (the ungaugeable region), after 
which quantities are taken from the aft 
probe. 


— Assumes single engine flow rates. 


Rules of Thumb 


e 2 ft/sec ~1n. mi. 
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% to AV conversions: 


- 1% of OMS ~ 5-6 ft/sec 
- 1% of RCS - 1 ft/sec 


Accelerations: 


- 20М5: ~ 2 ft/sec? 
- 1OMS: ~1 ft/sec? 
- ARCS: ~ 0.6 ft/sec? 


Flow rates: 

- 20 lbs/sec/OME 

- 10 lbs/sec/4+X ARCS 
% to lb conversions: 


- 1% of OMS ~ 130 lb of propellant 
- 1% of RCS - 22 lb of propellant 


VGO fraction of AVTOT: 
20М8 | 1ОМ5 | ARCS FRCS 
VGO X +1 +1 +1 4 
VGO Y 0 41/5 0 0 
VGOZ | +1/4 +1/4 +1/6 +1/3 
ENG FAIL / PRPLT FAIL 
“L(R) OMS PC” = OX Blockage 
(Naff OX IN P) 
“L(R) OMS TEMP" = FU Blockage 
(Naff FU IN P) 
For OMS ENG FAIL: 


- OX(FU) IN P is now higher than steady- 
state inlet pressures. 


- Engine lost, but propellant still available 
through crossfeed or interconnect. 

For OMS PRPLT FAIL: 

- OX(FU) IN P is now lower than steady- 
state inlet pressures. 


— Both engine and propellant lost (i.e. 
neither crossfeed nor interconnect are 
available). 
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Performing 2-ENG OMS Burns 


When burn starts: 


- Time the burn (in the event а manual 
shutdown is required). 


OMS Assist and ATO dumps should 
also be timed. Backs up OMS quantity 
gauging. (Needed for OMS 1/2 
Targeting.) 

- Check OMS Pc > 80%. 

- Check ball valves > 70%. 

- Note decreasing AVTOT. 


- Monitor engine inlet pressures. Note 
steady-state values. 


For first OMS FAIL (ENG or PRPLT): 


— If ENG FAIL, crossfeed at % AVTOT 
remaining. 
Perform “hot crossfeed” (momentarily 
tie tanks) to maintain good propellant 
flow to remaining OMS engine. 


- If PRPLT FAIL during OMS 2 or orbit 
burns, stop the burn (provided HP > MIN 
HP). 

- If PRPLT FAIL during the deorbit burn, 
will attempt a crossfeed only after good 
propellant has run out. (Possibility of 


blockage being downstream of crossfeed 
Т .) 


For second OMS FAIL (ENG or PRPLT): 


— Interconnect good OMS propellant to 
RCS. 
Perform “hot  intereconnect” to 
maintain good propellant flow to RCS 
jets. 


- Determine RCS burn time using OMS% 
vs. RCS AV chart. 


OMS quantity gauging not active 
without an OMS engine burning. 


Double burn time if only 2 +X jets (due 
to RCS failures, FA1/FA2 failures, etc.). 


- If no good OMS propellant remains, 
complete burn using RCS propellant (but 
preserve enough for use during 
deorbit/entry). 
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ОМ5 КМ 


Three events must happen before guidance 
will downmode: 


- L(R) OMS Pc FAIL (Pc « 80%) 
— Loss of acceleration 


– L(R) OMS ENG - OFF 


OMS} оп MNVR EXEC display triggered by 
OMS Pc FAIL and loss of acceleration. (For 
BFS, OMS} triggered by OMS Рс FAIL only.) 


If OMS Pc failed high prior to burn, OMS RM 
will set the affected OMS Pc FAIL flag at 
TIG - 15 sec. (Guidance can still downmode.) 


Auto Downmode 


- Occurs when a certain CNTL bus fails 
(specifically at Pnl СЗ), and subsequently 
there is an OMS FAIL (ENG or PRPLT). 

For LOMS: CNTL AB1 or AB2 
For ROMS: CNTL CA1 or CA2 


- OMS RM into thinks L(R) OMS ENG 
switch is in the OFF position. 


Failure of CNTL AB1 or AB2 (CA1 or 
CA2) puts the L(R) OMS ENG switch 
in dilemma. 


The OMS ENG default position when 
in dilemma is OFF. 


— Crew assumes OMS} is a PRPLT FAIL. 


Failure signature looks like ENG 
FAIL (ENG УГУ 1 & 2 « 70%). 


Guidance immediately downmodes 
once it sees OMS Pc FAIL and loss of 
acceleration. (OMS ENG - OFF 
already set in software, regardless of 
actual switch position.) 


Ball valves closed before crew can 
diagnose ENG FAIL vs. PRPLT FAIL. 


- No GN2 purge post burn on affected 
engine. 


Software thinks OMS ENG switch is 
in OFF, as opposed to ARM/PRESS. 
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е No Guidance Downmode RCS 
— Two scenarios will prevent Guidance General 
from downmoding, even after the failed 
OMS engine switch is taken to OFF. е Nominal uses: 


OMS Pc failed high during burn — GPCs — Rotational and translational control of the 


will never see Pc < 80%, thus never orbiter. 
setting the OMS Pc FAIL flag. (Crew — Small orbital transfers (AV < 6 fps). 
can see OMS Pc off-scale high Aft RCS burns: 


indications on MEDS meter.) OPS1/3: 4+Х јез 


MDM ЕАЗ(4) failures - Commfaults ОР52: 2 +X jets 


L(R) OMS Pc, so GPCs will never see Fwd RCS burns: 2-X jets 
OMS Pc < 80%, thus never setting - Forward window protection during 
the OMS Pc FAIL flag. (Crew can SRB SEP. 


still see OMS Pc on MEDS meter.) 
e Off-nominal uses: 


— After first OMS FAIL: — Abort dumps 


dr ns T | - Single engine го! control (SERC) 
ТУС DAP will gimbal remaining engine 


to keep thrust vector through c.g. - OMS burn completion 
- RCS wraparound 
ADI error needles will be incorrect, = RCS deorbit burn 
since they will still be based on a 
two-engine attitude. RCS Subsystems 


Guidance commands cut off too soon. 


; ; : Е е Two identical, independent systems for OX 
(Still thinks it has two OMS engines.) 


and FU. (OX and FU sides are overlaid on 


Results in about a 6 ft/sec underburn. ЕРЕ schematic.) 

— After second OMS FAIL: „ейи Tanks 
Stuck in TVC DAP (i.e., no downmode - One helium tank for OX; one helium tank 
to RCS). Causes sluggish control (i.e., for FU. 


"sloppy DAP") because TVC DAP has 


— Helium provides pressurization to 
broader rate deadbands than RCS DAP. 


maintain propellant flow to the RCS jets. 


ТУС DAP will downmode to RCS DAP - Helium tank leaks. 
when either: Ascent: Crossfeed from non-leaking 
ТСО = 0, side to protect for ЕТ SEP. 


Orbit: Set up an RCS burn to “max 
blowdown” in the propellant tanks 


9 
Crew maneuvers vehicle 90° out РА) 
of attitude. Entry: When helium has all leaked out, 
crossfeed from non-leaking side to 
maintain entry attitude control. 


Major mode change, or 
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e Propellant Tanks 
- Store the propellants: 


OX = nitrogen tetroxide 
FU = monomethyl hydrazine 


— Fwd RCS tanks designed to operate in 
zero g only. 


- Propellant tank leaks: 


Ascent: Crossfeed from non-leaking 
side to protect for ET SEP. 


Orbit: Set up an RCS burn to depletion 
(rather than let propellant accumulate 
in aft compartment). 


Entry: When propellant has all leaked 
out, crossfeed from non-leaking side 
to maintain entry attitude control. 


е OMS/RCS interfaces 


— RCS апа OMS use the same OX and FU. 


- RCS jets can be used in one of three 
configurations: 

Straight feed [i.e., ЦК) RCS propellant 
feeding L(R) RCS jets] 

Crossfeed [i.e ІК) RCS propellant 
feeding all aft RCS jets] 

Interconnect [ie, OMS propellant 
feeding all aft RCS jets] 

— Cannot interconnect RCS propellant to 
OMS engine. (Could damage the RCS 
tanks.) 

— Fwd RCS cannot crossfeed with Aft RCS, 
nor can it interconnect to OMS. 

At one time, engineers considered 
providing for a Fwd RCS interconnect, 
but this effort was later abandoned. 


е Jets 
— Two kind of jets: Primary and Vernier • Heaters 
- Primary jets: - Collection of pod heaters, panel heaters 
Total of 38 jet and line heaters, designed to prevent the 
otal of 38 jets: 


14 Fwd; 12 aft left; 12 aft right 


Used for coarse attitude control and 
orbital translations. 


Each jet produces 870 Ib thrust. 


— Vernier jets: 
Total of 6 jets: 
2 Fwd; 2 aft left; 2 aft right 


Used for fine attitude control during 
OPS 2/8 only. 


Each jet produces 24 Ib thrust. 


propellants from freezing. 


Two circuits: “А” (typically used 
during first half of mission) and "B" 
(typically used during second half). 


Caution: Simultaneously running both 
^A" and "B" OMS pods heaters will 
result in burnout of the heaters. 


— Collection of jet heaters (for each 
manifold) to keep jet injectors at 
operating temperatures. 


RCS Quantity Gauging 
— Jet Nomenclature: 
Х Ү 7 ® Quantity is calculated based on pressure, 
2 . : volume, and temperature (PVT) 
X = Pod: F (fwd) L (left), R (right) relationships. 


У = Manifold: 1, 2,3, 4, 5 


Z = Plume Direction: U (ар), D (dwn), ° A helium leak causes erroneous quantity 


L (left), R (right), F (fwd), A (aft) 


- Primary jets аге on manifolds 1 through 4; 
vernier jets are on manifold 5. 


- Alljets are non-gimbaling. 
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calculations. 


PVT calculations assume that helium 
moves only from the helium tank into the 
propellant tank. 


e Long RCS burns can temporarily corrupt 


quantity calculations. 


Long RCS burns cause rapid temperature 
drops in the helium tank, which impact the 
PVT calculations. 


e A difference of 9.5% between OX and FU 


quantities will trigger “F(L,R) RCS LEAK” 
fault message. Message will reannunciate 
every 9.5% increment. 


PASS Jet RM 


e Jet Failures 


— FAIL OFF - Jet commanded to fire, but no 
rise in chamber pressure. 


— FAIL ON - Jet fires, but with no fire 
command issued. 


- FAIL LK - Jet injector temperatures fall 
below operating levels (possibly caused 
by leaking propellant that is freezing on 
the injectors). 


e Jet Fail Limit 


- Initialized at two per pod. Can be 


modified via PASS SPEC 23. 
- Applies only to PRI jets. 


- Applies only to jets that FAIL OFF or 
FAIL LK. 


e Situations when a jet is no longer available: 


- Manually deselected (PASS SPEC 23). 


— Auto deselected, due to either FAIL OFF 
or FAIL LK (if still below jet fail limit). 


FAIL ON is not auto deselected. 
- Manifold status is “CL”, resulting from: 
1. Taking МАМЕ ISOL to CL. 


2. Overriding МАМЕ STAT to CL оп 
PASS SPEC 23. 


Commfaulted manifold status. 
RCS manifold dilemma. 


JET FAIL ON, with AUTO МАМЕ CL 
enabled (OPS 2,8 only). 


C-25 


USA007587 
Rev. A 


Resetting RM (via PASS SPEC 23): 


— ITEM 45 JET RESET) resets RM (їе, 
clears FAIL OFF, ON, or LK) for all jets 
that are not deselected. 


- DESINH once: 
Places affected jet in last priority. 


Prevents FAIL OFF or FAIL LK from 
auto deselecting affect jet. 


Does not reselect jet. 


- DES INH twice (.е., toggle RM) resets 
RM and leaves affected jet in last priority. 


Impacts from BCE STRG X 


- “ВСЕ STRG X B" impacts Fwd RCS; 
“ВСЕ STRG X О” affects Aft RCS. 


- Manifold status changes to “CLM”. (Jets 
are not available.) 


- СРС can no longer annunciate FAIL 
OFF, FAIL ON, or FAIL LK. 


— If jets needed for attitude control, crew 
can override manifold status to “OPM” to 
regain affected jets. 


BCE STRG X only takes away 
feedback to the СРС. Jets can still be 
commanded to fire. 


BFS Jet RM Differences 
No SPEC 23. 


BFS annunciates FAIL OFF and FAIL ОМ 
only when engaged. BFS does not 
annuniciate FAIL LK. 


BFS does not show manifold status unless 
engaged. 


BFS will annunciate and auto deselect only 
the first FAIL OFF, and only if it is not 
previously FAIL ON. 


BFS will simply annunciate subsequent 
FAIL OFF jets. 
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Kx - Limits the number of jets that fire 
Reconfiguring RCS simultaneously. 
е Rules of Thumb The flow rate from a large number of jet 
: firings could damage the propellant 
1. Do not starve a jet. tank 


2. Do not feed a leak. 


: Throwing the MSTR XFEED switch will 
3. Do not tie tanks. 


limit simultaneous jet firings, even if 
» When securing RCS, work from bottom up. crossfeed was configured manually. 
1. Close manifolds. Interconnected Abort Dumps 

2. Close crossfeed valves (if applicable). 

Assumes the GPC position for the AFT L,R RCS TK 


3 Close tank isolations. 
ананы оқалы ISOL and XFEED, as well ав the L,R OMS ХЕЕЕР. 


4. Close helium isolation. 


e For interconnected abort dumps, Smart 


When reopening RCS, work from top down. 
Ё завь % БӨЗ Interconnect will automatically reconfigure 


1. Open helium isolation. OMS and RCS valves when dump 15 
2. Open tank isolations. initiated. 
3. Open crossfeed valves (if applicable). — Interconnected dumps normally burn 
4. Open manifolds 2 OMS engines with all 24 aft RCS jets 
| | (1.е., 2+24 dump). 
Auto Crossfeed - If OMS or RCS valves do not configure 


properly (due to DPS or EPS failures, 
etc.), the dump will burn either: 


2 OMS engines with 10 aft RCS jets 


Assumes AFT L,R RCS TK ISOL and XFEED are 
in GPC position 


e Auto crossfeed sequence (іе, 2+10 dump), ын : 
2 OMS engines only, depending оп 
— Active in PASS OPS 1, 3, and 6. which valves are misconfigured. 


- If OX(FU) TK P < 220 psi, crossfeed from % Smart Interconnect will automatically 
other pod automatically established. reconfigure OMS and RCS valves back to 


straight feed when dump is complete. 
Triggers “L(R) RCS XFEED” fault 


message. — Certain DPS and EPS failures can result in 
the OMS and RCS being left with tied 
— Protects against He REG FAIL LOW. tanks post-dump. 
е Master crossfeed sequence - MCC may call the crew to manually 


reconfigure OMS and RCS post-dump. 
- Available in PASS OPS 1, 3, and 6. 


- Reduces crossfeed from L(R) RCS to a 
single switch throw. 


— Used especially for leaks during dynamic 
flight. 
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CONTENTS 


CCTV System 
Communications System 
C/W System 


Landing/ Deceleration System 
Lighting System 
Mechanical Systems 


TAEM and A/L 
Performance Rules of Thumb 


This appendix is a compilation of the rules of 
thumb from the body of this manual. Topics 
are organized alphabetically keyed оп 
commonly used acronyms and abbreviations. 


APU/HYD 


e APU fuel usage rates vary with loading, but 
average 1% per minute (З to 3.5 Ib/minute). 
Usage rates are reduced by about two thirds if 
the hydraulic main pump is taken to low 
pressure (HYD MAIN PUMP PRESS switch 
on panel R2 set to LOW), as is done during 
the abort once around deorbit coast period. 


e The APU injector cooling tank shared by all 
three APUs contains enough water for 21 
minutes of continuous flow. This is enough 
for six complete 3.5-minute injector cooling 
cycles. 


e If all water spray boiler cooling is lost to the 
lube oil after an APU reaches full operating 
temperatures, only 4 to 5 minutes of 
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operating time are available before non- 
catastrophic bearing seizure occurs. The APU 
should be able to support from Mach 1 to the 
ground. Expect overtemp alarms, and MCC 
should call for immediate shutdown after 
wheels stopped. 


Ascent 


* Monitor roll program on the ADI and BFS 
ASCENT TRAJ display. 


• Before L/O +90 seconds, BFS engage is the 
crew’s only option for loss of guidance and/or 
control. After 90 seconds, the crew can try CSS. 


® Monitor the trajectory on the ASCENT ADI 
cue card and the PASS and BFS ASCENT | 
TRAJ displays. The Shuttle bug and 
predictors should follow the nominal 
trajectory line. Also monitor the HSI for the 
inertial velocity to be in the desired orbit 
insertion plane. 


е Monitor guidance convergence by observing 
PASS and BFS TMECOs converging to 
expected time. 


e Ifthe crew takes CSS, they should take manual 
throttles. If the crew takes manual throttles, 
manual shutdown is required unless a low 
level shutdown occurs due to low 
performance. The cue for MECO is the BFS 
МЕСО cutoff bug or planned МЕСО V; minus 
150 fps. 


e Use OMS 1 TGTING cue card for system 
problems and OMS 1/2 TGTING cue card for 
performance problems to determine proper 
OMS 1 and 2 targets. 


CCTV System 


e When the VCU is powered on, the crew must 
wait 10 seconds before any CCTV commands 
can be accepted. This time is used to 
initialize the VCU. 


e Always wait at least 10 seconds after 
powering off a camera before powering it 
back on. This gives the iris enough time to 
fully close. 
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e Always wait at least 10 seconds after 
switching from the RMS wrist camera to the 
RMS elbow camera before switching back to 
wrist, and vice versa. This gives the iris 
enough time to fully close. 


• Never leave a payload bay camera in а 
manual mode (either semi- or full) while in 
direct sunlight or any bright light. Damage 
to the camera will result. 


е If neither you nor Mission Control is using a 
camera for extended periods, power it off to 
conserve energy and to keep it cool. 


Communications System 


* When the TDRS has an elevation of greater 
than +70 degrees or less than -60 degrees 
relative to the orbiter (as shown on OPS 201), 
there is a risk of degraded communications 
as the orbiter nose or tail blocks line of sight 
between the orbiter antenna and the TDRS. 


е SM OPS 201 Antenna display shows an S-band 
PM signal strength of 2.50 for the true received 
signal strength of 0 indicated on the F9 and 
ATU meters. 


C/W System 


® The SENSOR RESET switch on panel L1 
should be pressed when smoke concentration 
goes below 1.8. This prevents masking of 
alarms. 


e When panel R13U is not in use, the 
PARAMETER SELECT thumbwheels should 
be set to a value greater than 119. 


• Crewmembers should reset fault messages as 
quickly as possible after review to avoid 
covering other messages. 


* The fault summary should be reviewed 
regularly to avoid missed fault messages. 


DPS 


e Always deassign IDPs from fail to sync GPCs 
and reassign to good GPCs to avoid 
inadvertent entries (NBATs/restrings, burn 
targets, etc.). 


e Before OPS transitions and restrings, always 
verify the appropriate NBAT is what you 
want it to be; never assume that it is correct! 
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Also check the proper major function and 
GPC switch configuration. Post OPS transi- 
tions and restrings, check good configuration 
with SPEC 6. 


Make sure you have the correct memory 
configuration called up before you start 
making NBAT changes. 


During OPS transitions, keep “hands off” 
everything, including all switches and item 
entries. 


Always clear the Fault Message line as soon 
as you have seen the message; otherwise, you 
may miss subsequent annunciations from 
other failures. 


Post BFS engage, check to ensure that all 
active PASS GPCs have recognized the 
engage (both MODE and OUTPUT talkbacks 
are barberpole). If not, take the offending 
GPC to HALT (or if this does not work, 
power it OFF) immediately to avoid I/O 
problems on the flight critical strings. 


It is a very good idea to resume SPECs and 
DISPs from IDPs when not using them or 
before going to another major function on 
that IDP. 


When moding PASS GPCs into the common 
set (Le, STBY-RUN), always pause 10 
seconds before making further switch throws 
or item entries to avoid a possible fail-to-sync 
and to ensure proper common set 
initialization. 


It is important to be able to identity GPC 
failures, for Mission Control often has little 
insight. The information you provide will 
affect Mission Control analysis and its ability 
to plan for subsequent failures (both DPS and 
non DPS). 


Always hard assign IDPs (both PASS and 
BFS) via PASS IDPs (BFS will DK listen). 
You can cause dual commanders if you try to 
assign BFS to an IDP that a PASS СРС is still 
driving via a BFS IDP keyboard. 


Always distribute your IDPs among different 
GPCs. On orbit, always be sure SM is not on 
all IDPs at the same time; if you lose SM, you 


also lose PASS DPS display interface. The 
same applies for single GPC GNC OPS 
configuration. 


When using the GPC MODE switch, always 
take your hand off between positions. On 
past missions, there have been problems with 
the switch being in two positions at the same 
time. This problem can occur on other 
orbiter switches too. It is a good idea to 
always pause slightly in each switch detent 
to ensure the contacts are made and 
recognized by the GPCs. 


The IDP/CRT SEL switch should always be 
checked before making a keyboard entry, 
and data should always be checked on the 
DPS display scratch line before it is entered. 


When moving GPC mode switches from 
RUN to STBY or STBY to RUN, refrain from 
moving any other GPC monitored switches 
or making keyboard entries for 10 seconds. 


ECLSS 


NOTE 


Numbers presented here are for typical 
orbit power and heat loads and may vary 
significantly depending on attitude and 
power loading. 


Supply water tanks fill at about 6.7 percent 
per hour (if filling тю а single tank), 
depending оп fuel cell load (.77 Ib/kW hr + 
1.6 Ib over 1%; 14 kW typical orbit power 
load). 


Water tanks empty at about 100 percent per 
hour for a water dump, about 50 percent per 
hour when using the FES high load 
evaporator for cooling with payload bay 
doors closed, and about 16 percent per hour 
when using the FES topping evaporator 
for supply water dumps on orbit with the 
doors open. 


On-orbit cold soak is good for 20 to 30 
minutes of cooling. Prelaunch Freon 
conditioning is good for about 5 minutes of 
cooling. 
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NH; boiler supply is good for 35 minutes of 
ground cooling for the first tank and 25 minutes 
for the second tank. 


A single сгуо О» tank is good for about 2 to 3 
days of orbit usage depending on crew size 
and power level. Н» tanks are sized to match 
O» usage. 


A single LiOH canister is usable for about 48 
man-hours. 


Choose the NH3 controller such that it is 
controlling to the slow Freon loop but not a 
dead loop. 


Entry 


2 OMS: TGO « AVTOT/2. 
1 OMS: ТСО ~ AVTOT. 
RCS: ТСО = 1.7 x AVTOT. 


Prior to the first bank, monitor vehicle 
attitude at 0 degrees bank and 40 degrees 
alpha. 


First bank (flight path angle capture) should 
occur at a drag acceleration of approximately 
3 fps? and/or q-bar of approximately 8 psf. 


Monitor the trajectory on the ENTRY 
ALPHA cue card, and the PASS and BFS 
TRAJ displays: 


The Shuttle bug superimposed on guidance 
box superimposed on nominal trajectory line. 


Actual drag equal to reference drag. 


Appropriate bank angle, H-dot, range 
and altitude. 


For an off-nominal trajectory, check that 
guidance is working to put the guidance box 
back on the Shuttle bug (zero range error) 
within the trajectory envelope. 


Attempt to contact MCC before taking CSS. 
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е If you must take CSS: 


— Control range by controlling drag. 


- Control drag by controlling H-dot. 


Hdot Desired - 
(Dcurrent - Dref) x 20 * Hdot Ref 


— Control H-dot by controlling H-double 
dot. 


- Control H-double dot by controlling 
bank angle. 


- Control everything slowly by small 
corrections. 


EPS 


Never close a circuit breaker or reset an 
RPC found out of configuration without 
MCC coordination. 


Loss of cooling to a fuel cell requires crew 
action within 9 minutes to prevent a 
catastrophic loss of crew/vehicle due to 
possible fuel cell fire and explosion. 


Any interruption of continuous AC power 
during ascent will result in the loss of main 


engine controller redundancy. Recon- 
figuration of AC powered equipment prior to 
MECO should be avoided. 


Never connect or reconnect power to a known 
shorted or failed component; this includes 
switch throws, circuit protection device 
resets, or bus ties. 


Fuel cell run limit prior to shutdown for loss 
of cooling is 9 minutes at a 7 kW nominal 
load. Run time varies inversely with fuel 
cell load. 


Three oxygen and hydrogen tanks are good 
for up to 8 days on orbit; five oxygen and 
hydrogen tanks are good for up to 12 days 
on orbit. Duration varies with crew 
complement and power load. SSPTS will 
extend on-orbit duration by lowering fuel cell 
loads. 
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А fuel cell hydrogen pump uses 0.3 
amps/AC phase; a coolant pump uses 0.5 
amps/ AC phase. 


EVA 


Always “make before break” tether 


protocol. 


use 


Do not use the glove as a hammer. 


EVA crewmember must remain tethered at 
all times. 


Slow and deliberate motion provides much 
greater stability than quick, jerky motions. 


Body positioning is 90 percent of the task. 


Each EVA crewmember should check out his 
or her own EMU. 


GNC 


The PASS FDIR for the RGAs, AAs, and 
aerosurfaces terminates after the first failure. 
After the first failure, crew management of 
the selection filter is required. For the BFS 
selection filter, crew management is always 
required. Proper selection filter management 
is required for proper control. 


For FCS channel management: 


— Never have more active channels on 
one GPC than another. 


— If there are two failures on the same 
actuator, take the remaining FCS chan- 
nels to OVERRIDE. 


- Always maintain two good commands 
and one good feedback on each 
aerosurface. 


- Delay 2 seconds between switch throws 
when moving FCS CHANNEL switches. 


— Port bypass, or port pop, is a mechanical 
means to avoid force fights; feedback 
deselection is a software means to avoid 
a bad input into the selection filter. 


For ascent, only the pilot's 5ВТС is active. To 
get manual throttles, the pilot must depress 
the TAKEOVER button and then match the 


commanded throttle setting. Manual rota- 
tional control is available only in PASS and 
must be both pitch and roll/yaw. 


For entry, both SBICs are active. То get 
manual speed brake, the CDR or pilot must 
depress the TAKEOVER button. Manual 
rotational control is available in either pitch or 
bank in PASS, and required in both axes in 
BES. 


For TACAN and ADTA management, talk to 
MCC before incorporating. 


Without communication, the crew will use 
the NO-COMM TACAN MGMT and ADTA 
MGMT cue card. 


Landing/Deceleration System 


Landing gear should not be deployed at 
equivalent airspeeds greater than 297 knots. 


+ 1 knot of touchdown speed corresponds to 
+ 100 feet of distance. 


Lighting System 


Power consumption of cockpit lighting can 
be as much as 1 to 2 kW with all lights on. 


When payload bay floodlights are turned off, 
they should remain unpowered for 10 to 16 
minutes prior to repowering. 


When payload bay floodlights are turned on, they 
should remain powered for 10 minutes prior to 
unpowering. 


Mechanical Systems 


Always use a timer when operating mechani- 
cal systems, noting either dual or single 
motor time. Do not continue driving if 
greater than the single motor time has 
elapsed without the mechanism reaching the 
desired state. If motion stops prematurely, 
take the mechanism switch(es) to Stop. 


MPS 


Direct insertion MECO is usually close to 
8 minutes 30 seconds. 
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For three engines at 104 percent, fuel con- 
sumption is about 1 percent propellant/ 
5 seconds. For three engines at 65 percent, 
fuel consumption is about 1 percent/8 
seconds. 


An SSME will consume approximately 
4 percent propellant per engine per minute at 
104 percent. Propellant remaining is dis- 
played on the PASS ASCENT TRAJ 2 display 
and is a guidance-calculated number. 


Selecting max throttles greatly increases the 
risk of a catastrophic failure occurring. As 
such, max throttles are only used in cases of 
severely degraded ascent performance. 


Five ways to set MECO confirmed are: 
- ЗРс’5 < 30% 
- 2Pc’s < 30% and a data path failure 


- 3 SAFING commands (i.e., pressing all 
three SSME pushbuttons) 


- OPS 104 PRO (OPS 602 PRO will not 
set MECO CONFIRMED) 


— Fast ET sep 


e MAIN ENGINE SHUT DOWN Pushbuttons: 


— With two good contacts, the pushbutton 
will generate both the SHUTDN 
command and the SAFING command. 


— With one commfaulted contact, the 
pushbutton will only generate the 
SAFING command. 


— With a broken contact (due to CNTL 
bus or a contact failed ОР), the 
pushbutton is in dilemma and will not 
generate the SHUTDN command nor 
the SAFING command. 


— A broken contact can be masked by a 
commfault (via FF MDM power cycle) 
so that the pushbutton can once again 
generate the SAFING command. 


— ASAFING command, in the presence of 
a Data Path Failure will set into motion 
three things: 1) mode guidance, 2) 
mode flight control, and 3) close the 
prevalves. 
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- Because BFS does not recognize 
commfaults, a commfaulted contact is 
the same as a broken contact. 


Do NOT use the MAIN ENGINE SHUT 
DOWN pushbutton for these cases: 


- Data Path Failure + Commfaulted 
button 


— Data Path Failure + Command Path 
Failure 


SHUTDN command either not generated 
(commfault) or is ignored by the controller 
(command path failure). 

SAFING command is generated. Coupled 
with a Data Path Failure, this closes the 
prevalves on a running engine, resulting in 
catastrophic shutdown. 


On panel R2, the MPS ENGINE POWER 
switches (or “АС switches”) look very 
similar to the He ISOLATION switches. Also, 
both sets of switches are located close 
together. Use caution. 


A Command Path Failure must always be 
shut down manually pre-MECO via AC/pb. 


Throwing the AC switches to OFF creates a 
Data Path Failure. 


Ап “SSME FAIL C(L,R)" message indicates 
that the GNC software has recognized an 
engine shut down. 


An engine with a Data Path Failure will 
never display a red MAIN ENGINE STATUS 
light, even after shutdown. 


Limits must be enabled on an engine when 
the helium regulator pressure begins to 
decay due to a helium leak. An SSME will 
almost certainly fail catastrophically if there 
is insufficient helium, and limit shutdown is 
inhibited. 


With three SSMEs running, ап hydraulic 
lockup or electric lockup will be shut down 
pre-MECO to protect NPSP in the event of a 
low-level cutoff. 
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e Actual throttle levels on the first stage 
throttle bucket can vary due to SRB thrust 
level dispersions. This is an artifact of “first 
stage adaptive guidance.” 


e Loss of an APU means the affected engine is 
in hydraulic lockup. Can also trigger “MPS 
CMD C(L,R)” messages post-MECO during 
MPS dump. 


e Manual shutdown cues of VI=23K (3-ENG), 
24.5K (2-ENG), and 22.5K (TAL) correspond 
roughly to 30 seconds before MECO. 


е APC4(5,6) or ALC1(2,3) Failures: 


— For ALC failure, BFS GNC SYS SUMM 1 
shows the following: 


ULL P LH2 12.0) 
Lo2 0.0 


- For APC failure, along with the same 
ULL P indications for an ALC failure, 
there is also an “SM2 APU SPD LO 1(2,3)” 
fault message. 


- C(L,R) Не ISOL A has failed closed. Do 
not attempt leak isolation steps. 


- Treat helium leaks on affected engine ав 
non-isolatable. 


OMS 


е 1 percent of OMS propellant 
= 6 fps AV 
=3 n.m. AHp 
= 130 Ibs (80 lbs oxidizer, 50 Ibs fuel) 


uses 40 psi of helium for long burns. 


е One OMS engine causes approximately 1 fps? 
acceleration. 


e For OMS ignition, there must be power and 
command to at least one coil on both control 
valves. 


e OMS TVC requires an enable discrete from the 
FF МОМ, and commands from the FA MDM. 


e FUEL INJECTOR TEMP message may be a 
signature of a bad temperature transducer or 
a fuel blockage. 


e CHAMBER PRESSURE message may be a 
signature of a bad pressure transducer or an 
oxidizer blockage. 


e There are several failures that inop OMS FDI 
(FA3(4) MDM commfault or Рс transducer 
failed high). 


e Always check redundant sources to confirm 
any malfunction. 


e An OMS engine failure post-MECO should be 
signified by a down arrow on the MNVR 
display. 


e Max blowdown оп the OMS is 
approximately 39 percent. 


• 1,000 Ib of OMS (approximately 8 percent) 
moves the X c.g. 1.5 inches aft and the Y c.g. 
0.5 inches left or right. 


е Max OMS quantity for landing = 21 percent. 


Orbit 


* In propellant-limited situations, use the 
following guidelines: 


- Stay in VERN as much as possible. 


— To conserve forward RCS, use TAIL 
ONLY control mode. 


- During prox ops, when controlling out- 
of-plane errors, start as early as 
possible, wait for the node to make 
inputs to null rates, watch the dead- 
bands, and 40 not fight orbital 
mechanics effects. 


е TRAJECTORY: 
- NC: Sets up 1-геу transfer to Ti 


— NCC: 1st onboard targeted burn targets 
the Ti point 


— Ti: Burn (usually posigrade) that sends 
the orbiter into proximity with the 
target, uses RADAR data 


— МС1-4: Midcourse correction burns 
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- Out-of-Plane Null (OOPN): Usually 
between MC1 and MC2, places target 
and orbiter co-planar (Y = 0) 


- Ti Delay: Places orbiter in a football- 
shaped holding pattern, posigrade (Ti 
DVX +3 fps) 


SOURCE OF ERRORS: Trajectory 


Attitude maneuvers and jet cross 
coupling 


Burn trims 
Orbiter vents (APU, FES, etc.) 
Drag uncertainties 

e STAR TRACKER PASS: 


- Deselect an IMU during ST pass to 
reach 2-level (RM will prime select an 
IMU for attitude) 


- Monitor RESIDS < 0.05 (BREAK 
TRACK if locked onto star or debris) 


— Assumes on PROP vector, FDF 
provides criteria to select FLTR vector 


SOURCE OF ERRORS: Star Tracker Pass 


Prime selected IMU attitude problem 
Either IMU accelerometer problems 
Star tracker bias 


Maneuvers and length of time since last 
state vector update 


Marking on a star instead of the target 
е RADAR PASS: 


- Use radar if range «135 k (range 
eclipsing at greater ranges) 


— Radar data verifies data from ST pass 


— Procedure handles either FLTR or 
PROP vector selected 
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- Procedure provides criteria to select 
FLTR vector or to do FLTR to PROP 
vector transfer 


- INH angles data and mode radar to 
ATRK during maneuvers to burn 
attitude 


SOURCE OF ERRORS: RADAR Pass 


Range eclipsing 
EL/AZ greater than 30 deg 
Ku biases (range). 
e TARGETING: 
- Onboard targeting done on SPEC 34 


- Load BASE TIME (Ti TIG) to TGT SET 
#1 


- Load and verify ТСТ SETs with ITEM 
1+ 


- Compute burn solutions with ITEM 28 


- МС2 ТІС based on elevation angle 
constraint (rather than а particular 
time), so MC2 TIG can change 


-3 and +7 minute TIG slip limits 


MC2 TIG becomes the new BASE 
TIME 


е NAV MANAGEMENT: 
- Always have a FLTR vector 


- Upon RNDZ NAV enable, PROP vector 
is created and TGT vector begins prop- 
agating 


- Perform FLTR to PROP vector transfer 
after new sensor acquisition 


- If commfault or suspect bad data, then 
troubleshoot and ask questions 


e BURNS: 


- AV <4 fps - Multi-axis RCS burn 
(DAP:LVLH) 
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- AV >4 fps - +X RCS burn (maneuver to 
attitude, then DAP:INTL) 


- AV >6 fps - OMS burn (maneuver to 
attitude, DAP:AUTO) 


- Posigrade burns: Thrust Vector Roll 
(TVR) =0 


- Retrograde burns: TVR = 180 


- For RCS burns, DAP TRANS: NORM 
until VGO <1 fps then PULSE 


- If VGO Zis positive: burn Х, У, Z 
- If VGO Zis negative: burn Z, X, Y 
e PTG/DAP MANAGEMENT: 


- -Z target track until reaching the R-bar, 
then +ZLV 


- A7/VERN - Used for attitude hold (1 
deg attitude deadband, 0.016 deg/sec 
rotation rate) 


- B7/PRI - Used for maneuvers (2 deg 
attitude deadband, 0.5 deg/sec rotation 
rate) 


- TRANS pulse size = 0.1 fps during 
RNDZ, .05 fps during prox ops 


е SYSTEMS CONCERNS (single point): 
- GNCGPC FAIL: 


2 GNC GPCs are required for Ti and 
PROX OPS 


RNDZ NAV is disabled when go 
through OPS 0 (such as during 
redundant set expansion or con- 
traction). Only the FLTR vector is 
saved when RNDZ NAV is disabled. 
Restrings do not affect RNDZ NAV 


CNCL pointing option (ТСТ ID = 1) before 
RNDZ NAV disabled 


MDM FF3: 
Loss of VERN jets 


Loss of RADAR data to NAV (display 
on Panel A2 is unaffected 


Loss of -Y star tracker 
MDM ЕА1 or FA2: 

Loss of VERN jets 
MDM FF1: 

Loss of -Z star tracker 


PL 1: 


Loss of automatic Ku pointing (Ku 
modes: GPC and GDSG lost) 


IMU 2 - 
redundancy 


Restring 1221 for IMU 


e MISCELLANEOUS: 


1 fps posigrade or retrograde =: 

16 kft downtrack/rev 

3.5 kft radial/0.5 rev 

0.5 nm altitude change (HA or HP) 
1 fps radial =: 

3.5 kft downtrack/0.5 rev 


900 ft radial/0.25 and 0.75 rev 
(decoupled from the other axis) 


1 fps Out of Plane = 900 ft/0.5 rev 
(decoupled from the other axis) 


LVLH rate = 0.06 deg/sec; 4 deg/min; 
360 deg/90 min 


Expending about 35-40 lb of RCS 
propellant to maintain attitude results 
in a cross-coupling of 1 fps in -Z 
direction 
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— In propellant-limited situations, use the 
following guidelines: 


Stay in VERN as much as possible 


To conserve forward RCS, use TAIL 
ONLY control mode 


During prox ops, when controlling 
out-of-plane errors, start as early as 
possible, wait for the node to make 
inputs to null rates, watch the 
deadbands, and do not fight orbital 
mechanics effects 


PDRS 


e Whenever there are both talkbacks and DPS 


displays that reflect microswitch status, they 
should ALWAYS both be checked during 
any operation affecting them. 


Whenever troubleshooting RMS 
malfunctions in the long-form MAL book, 
always READ AHEAD. The MALs 
sometimes may require an operator response 
after the execution of the block, which is 
listed in the next block, depending on the 
path that is taken. 


The hand controllers are rate-proportional 
and are extremely sensitive. They should be 
held in such a way that you can control the 
full range of inputs without ever stopping to 
rearrange your hand. Care must be taken to 
not overcontrol the inputs. A good practice 
is to slowly and steadily input a desired 
command, wait patiently until you see the 
reactions of that command on the arm, and 
as the desired motion is achieved, slowly 
back off the input. Ideally, you should reach 
the axis detent at the same time the arm 
achieves the desired position and attitude. 


MPM motion may cease during deployment 
or stowage before the expected micro- 
switches are made. This is due to the fact 
that the last part of travel in either direction 
is when the overcenter lock is locking. 
Therefore, don’t turn off the PORT RMS 
switch when visible motion stops. Wait for 
the microswitches. 


Practice safety habits, the most important of 
which are brakes on, then power off (if 
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required) for abnormal joint response and RCS 
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use EE CC for abnormal EE ops during the 
specified conditions. 


During arm cradling, periodically check all 
joint angles to make sure that joints that you 
have already aligned to zero have not 
moved. 


CCTV cameras have a tendency to malfunc- 
tion at the most inconvenient times. Expect 
this and know how to perform all operations 
without cameras. 


Develop a scan pattern that encompasses 
window, CCTV, and panel status. 


Always remember what the DAP should be 
for the operations you are performing. In 
addition, keep in mind the down mode 
option for the DAP in case the arm enters an 
unexpected singularity or reach limit. 


Never rotate the MODE switch through 
DIRECT while the brakes are on. This actually 
puts the arm in mode, and sets you up for a 
possible runaway if a SINGLE/ DIRECT DRIVE 
switch failure occurs or is present. 


Verify the RATE switch setting by feel and 
talkback status. This should be done EVERY 
TIME prior to moving the arm, regardless of 
mode. 


Make sure you know the proper definitions 


of “cradling,” “stowing,” “berthing,” 
“mating,” and “installing.” 
Rates for berthing/unberthing: Usually 


maintain rates at about 0.01 to 0.02 ft/sec 
between Z = 414 and -438. For Z « -438 (away 
from the bay) rates can be increased 
somewhat. 


For berthing or unberthing of payloads with 
keel trunnions: the keel pin enters/exits the 
AKA when the longeron trunnions are at the 
top of the built-in 8-inch PRLA guides. 
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1% RCS prop = 1 fps AV. 
1% RCS prop = 22 lb. 


1,000 lbs of ARCS prop moves X c.g. 1.2 in, X 
c.g. + 0.4 in. 


1,000 Ibs of FRCS prop moves X c.g. -3.5 in. 
ARCS max blowdown qty 24%. 
FRCS max blowdown qty 22%. 


Loss of a single downfiring vernier jet is loss 
of vernier mode. 


If fuel tank pressure is 20 psi higher than the 
oxidizer tank pressure, then verniers are 
NO-GO. 


Always secure the RCS from the manifolds to 
the helium tanks. 


Always open the RCS from the helium tanks 
to the manifolds. 


ТАЕМ апа АЛ. 


• А 100-ft-difference in gear deploy altitude 


equals about 250 ft of touchdown energy. 
Gear deploy should not be delayed past 200 
feet altitude. 


90 ft of touchdown distance corresponds to 1 
knot of airspeed. 


TAEM guidance uses pitch to control range, 
bank angle to control ground track, and 
speed brake to control q-bar. 


Overhead HAC with NEP allows the most 
downmode options for energy. 


Fly theta limits at Mach < 2 (NLT Mach 1.5) if 
air data is not incorporated to G&C. Maxi- 
mum bank angle is 50 degrees. 


OGS is 20 degrees lightweight (< 222,000 Ib) 
and 18 degrees heavyweight (> 222,000 Ib). 
Aimpoint is 7,500 ft nominal and 6,500 close- 
in. Touchdown speed is 205 knots heavy- 
weight and 195 knots lightweight. 


Chute deploy at 195 knots. 


Start derotation with beep trim at 185 KEAS at 
approx. 2 deg/sec. At nose gear touchdown, 
manually back up WOW/WONG. 


During training, pilots should strive for a 
threshold crossing height of 25 to 30 feet on 
nominal approaches. Touchdown goals are 
airspeed within 5 knots of the target value, 
sink rate within structural limits, negligible 
lateral drift, and minimal RHC activity. A 
good target value for sink rate is 3 fps or less, 
insuring ample margin before violating limits. 
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With NWS in 1 or 2, the orbiter tends to turn 
into a crosswind. With NWS OFF, the orbiter 
will tend to turn away from a crosswind. 


If the orbiter is landing with a known failed 
tire, special landing techniques are used to 
try to save the second tire on that axle. 


If both main gear tires fail on one side, the 
orbiter will tend to turn toward that side. 
The turning moment due to crosswind can 
either reinforce or reduce this effect, as will 
the drag chute due to weathervane effects. 
The orbiter will turn into the crosswind and 
the drag chute will also cause the orbiter to 
turn into the wind. 


If the flat tire is on the upwind side, rudder 
pedal input opposite the blown tire will be 
required. If the flat tire is on the downwind 
side, the effects are balanced and minimal 
rudder input is required. 


Flight Rules call for landing with an existing 
crosswind on the same side as a known or 
expected bad tire. 
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Performance Rules of Thumb 


ASCENT DESCENT PROPELLANT 
Ascent Performance Margin Хса Limits 1 deg of plane change = 440 ft/s 
Management Reserve Rea. (Ibs) FWD = 1076.7 in (RTLS = 1079.0 in) 
Pre Flight Design Requirements AFT = 1109.0 in OMS philosophy 


Document = 3500 
Flight Design Requirements 
Document = 2500 
Cargo Integration Review = 1500 
Flight Planning Stowage 
Review = 1500 
FPR = 4652 
ORBIT 


1 hr launch delay = change in 
orbital noon by 4 minutes 


Ascending node 

28.5 deg - 1st ascending node 
is @ Long = 173.38 East 
57 deg = 121.55 West 


MISCELLANEOUS 


Orbiters 

OV103 - Discovery 
OV104 - Atlantis 
OV105 - Endeavor 


Min planned flt duration - 96 hours 


Max/Min Beta Angle 
Max = 23.5 + orbital inclination 
Min - 23.5 - orbital inclination 
lime 
СОТ = GMT-5hr 
CST = СМТ - 6 hr 
Daylight savings time from 
1st Sunday in April to 
last Sunday in October 


CONT AFT = 1119.0 in 


D/O Delta V's 

Descending approach is worst case AV 

90 deg prebank will decrease AV ~ 10 ft/s 
(function of altitude) 


If Xcg > 1091.5: 1 in Xcg = 2.2 miles 

If Xcg < 1091.5: 1 in Xcg = 1.1 miles 

As Xcg increases (more aft), XR decreases 

1 nm XR = 5780 Ibs EI weight 

1 nm XR = 4.38 nm D/O altitude 

As altitude and weight increase, XR increases 

As inclination increases, XR increases (non-linear) 
As temp increases, XR increases (non-linear) 


Touchdown speeds 
195 kts if TD weight < 222 k Ibs 
205 kts if TD weight > 222 k Ibs 


ДТ Zz = 2- -2 2- 2- 2- 

10 kts slower if short field зреедбгаке 

guidance mode is used if 200 k Ib < TD weight 

| <245 k Ibs N 
2 ЖЖ 2- zZz ZE 


Derotation 185 KGS with beep trim (Prime) 
or with RHC (manual ) derotation (Backup) 


2-2 2-2 


Mass Moment 
MM = TD Weight * (1172.3 - Xcg)/12 
for medium lakebed runways 
If MM > 1.47 M ft-lbs Concrete desire 
If MM > 1.54 M ft-lbs Concrete required 
Note: If TD Xcg not known, use 

Xcg @M=3.5+ 1.5 in 


Landing Weight Limits 

EOM 233 К Ibs 

RTLS 242 - 248 k Ibs * 

TAL 241 - 248 k Ibs * 

AOA 233 - 240 k Ibs * 

(Abort limits a function of Inclination) 


Noctilucent Clouds 
If Inc > 50, do not enter on descending opportunity 
June through August. 


RENDEZVOUS 


1 deg of phasing/hour = 10 nm of A height 

1 deg of phasing = 60 nm 

17.5 ft/s burn changes other side of orbit 10 nm 
440 ft/s burn will change plane by 1 deg of wedge 
1 deg of ARAAN occurs for each relative lap 


1 ft/s = 21.8 lbs OMS Q 220 k Ibs ~1/6% 
1.78 ft/s = 1 пт 


Maximum OMS load 
OV103/4 = 25064 Ibs 

Min = 10800 Ibs 

Max OMS ballast = 4000 Ibs 
1% OMS = 130 Ibs/side 


Hard Ballast 
OV103/104 - Bay 13 


RCS philosophy 

1 ft/s = 25 Ibs (+ X) ог 35 - 40 Ibs 
(multi axis) @ 220 К Ibs 

Max burn = 250 sec = 55 fps 

Full FRCS = 2446 Ibs 

ET blowdown offload = 2225 Ibs 

Min FRCS - 1862 Ibs 

Full ARCS = 4970 Ibs (over 100%) 

1% ARCS = 22 Ibs/side 


IINTERCONNECT logic 

If OMS < 14,000 Ibs, I/C off 

If OMS > 17,000 Ibs, ИС on 

If 14 К < OMS < 17 k, analysis req. 


ECS - N2 


OV103/4 

5.28 Ibs/day for 4 person crew @ 14.7 psi 
add .114 Ibs/day for additional crewmember 
3.66 Ibs/day for 4 person crew @ 10.2 psi 
add .079 Ibs/day for additional crewmember 


Dry wt 
83 Ibm 


Fully loaded wt 
143 Ibm 


N2 
EPS 
.09 Ibm Hydrogen = 1 kwh 


Л Ibm Oxygen = 1 kwh 
.07 Ibm Oxygen/hour = cabin leak rate 


Dry wt Eully loaded wt 
H2 227 Ibm 319 Ibm 
02 215 Ibm 996 Ibm 


* Orbiter Engineering Memo VE3-90-096. 
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APPENDIX Е OI UPDATES 
CONTENTS 


OI-33 SUMMARY 
Change Requests 


OI-33 SUMMARY 


OI-33 FSW, like Ше OI-32 FSW, adds numerous 
capabilities as well as corrections to existing 
capabilities. Most of the OI-33 CRs changed details 
of flight software code but did not change how the 
vehicle systems are monitored or operated by the 
crew. Summarized below are the most operationally 
significant/apparent functional changes of this OI. 
The significant operational changes affect PASS 
enhancements, OMS gimbal selection, ADI rate 
pointer travel, GRTLS Alpha recovery, three-engine- 
out SERC, ET SEP improvement, and adds SPEC 54 
Bearing displays. 


Change Requests 


CR 93073: PASS Non-Universal Enhancement 
(PASS) 


Changes I/O ERROR and BCE STRG messages to 
Class 2 Caution and Warning (Master Alarm) from 
Class 3 (SM Alert) when not detected by the entire 
GPC redundant set. 


CR 93074A - MM102 Three Out SERC (PASS) 


Automatically enables Single Engine Roll Control 
(SERC) when three SSMEs are recognized as failed 
in first stage. 


e Eliminates the need to manually initiate SERC 
in “3 OUT First” block on the Contingency 
Abort Cue Card 


• Simplifies the Contingency Abort Cue Card by 
combining the “3 OUT FIRST” and “3 OUT 
SECOND” blocks into one procedural block, 
now titled “3 OUT COLOR” 


CR 93075D- Correct OMS ZAP Command 
Timing (PASS and BFS) 


Modifies the relationship between issuance of the Zap 
command and OMS TVC gimbal selection. 
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е No longer a need to perform OMS gimbal 
selection twice on the Мпот Exec Display as a 
result of a gimbal failure or GPC/MDM loss 


CR 93084: SPEC 60 Checkpoint Capability 
Enhancement (PASS) 


Adds SM Mass Memory assignment and checkpoint 
retrieval item entries to SPEC 60 “SM TABLE 
MAINT” Display. 


CR 93098A - Reverse Direction of ADI Rate 
Pointer Travel (PASS and BFS) 


ADI rate pointer direction of travel is reversed for all 
flight phases, except when functioning as HAC 
predictors during TAEM. 


e Rate pointers now move in the direction of 
vehicle rotation, which means they are no longer 
fly-to to null rates, instead they are fly-to to 
establish rates. 


CR 93160: Year End Roll Over (YERO) Reset 
(PASS) 


Allows in-flight reset to January 1 without an IPL 
and complicated procedures while maintaining a 
good state vector. 


CR 93174A - Improved GRTLS TAEM “Alpha 
Trap” (PASS & BFS) 


The alpha transition logic controlling the GRTLS 
Alpha Recovery to Nz Hold flight phase is separated 
into two I-loads, forming a transition hysteresis for 
moding to Nz Hold. 


e The logic is armed when alpha increases above 
45 °and fired when it subsequently decreases 
below 35° 


ө The existing Nz trigger for the Nz Hold phase is 
not changed with this CR. 


This prevents premature moding to Nz Hold by 
reducing the likelihood of a CSS or 3-engine-out 
contingency that is induced early into Nz Hold due 
to difficulty controlling alpha when flying Alpha 
Recovery post ET separation. 
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CR 93087E - RTLS ET Separation Improvements 
(PASS and BFS) 


Intact RTLS mated coast and ЕТ separation 
guidance and flight control are changed to increase 
the success rate of RTLS ET separation. With a GPC 
failure taking a manifold of jets in each pod, the 
success rate improves to something greater than 84 
percent with one sigma environment and systems 
dispersions present. 


e Alpha target for RTLS МЕСО is 0° (vs. -2° 
previously). 


• After 11.3 sec of mated coast, DAP commands a 
-0.8 deg/sec pitch rate that will result in an 
alpha of approximately -2.8 ° for ET separation. 


e Speedbrake is commanded to 80 percent 
immediately after MECO in ММ601 (not 
visible on the SPI until MM602, but can be 
monitored on GNC SYS SUMM 1). 


ө ET SEP INH message due to ап out-of-limit 
alpha is eliminated because the delay is changed 
from 6 seconds to 2.2 seconds. 


e Remaining changes are internal to the DAP 
(updated flight control laws to improve pitch 
and roll control authority). 


e Intact and POWERED CSS RTLS procedures 
are updated to reflect the new MECO alpha 
target and subsequent mated coast 
maneuvering. 


e The MPS CMD/HYD/ELEC Cue Card was 
updated to target engine shutdown when 
applicable on an RTLS, at an alpha of +2° 
(a = +2) (vs. -1 ° previously). 


CR 93090E - Bearing Displays - SPEC 54 (PASS) 


Adds SPEC 54 to PASS GNC during ascent and 
entry, a new phase tailored “BEARING” display 
that provides a geographical representation of the 
current and targeted trajectory in the horizontal 
plane relative to multiple landing sites. 
Additionally, a new item entry is added on the 
ENTRY TRAJ display to allow range monitoring of 
trajectory progress to two alternate sites, in addition 
to the currently selected site. 
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This display works in conjunction with the 
ASCENT and ENTRY TRAJ displays to provide 
trajectory situational awareness in both the 
vertical and horizontal planes. 


Improves real-time onboard assessment ој 
ascent, abort, and entry performance. 


SPEC 54 has different formats for ascent and for 
entry. 


ASCENT BEARING 


- Available in OPS 1 and MM601 (SPEC 54 
display will resume to TRAJ on transition 
from OPS 1 to OPS 3 or 6). 


- Plots against two contiguous longitude vs. 
geodetic latitude maps, including an inset 
window extending the map further 
downrange (latitude of larger map and 
smaller inset map is contiguous). RILS, 
ELS, and TAL abort landing sites are 
depicted on all the maps. 


- The desired target insertion plane is 
depicted by a yellow line. If a TAL abort is 
declared, a yellow crossrange-circle is also 
shown centered on the selected TAL site on 
the appropriate map. 


- Dashed lines, representing the launch 
azimuth groundtrack at the open and close 
of the launch window, are also displayed, 
extending out from KSC. 


- Current position of a yaw-oriented shuttle 
is depicted with attached velocity vector 
along with 30- and 60-second predictors. 


— Also displays an overbright “+” depicting 
an instantaneous impact point (IIP) should 
all three main engines fail at the current 
time. Based on ballistic entry biased with 
rudimentary approximation of entry 
lift/drag effects for ECAL aborts. 


- ITEM 41 entry in the upper-left corner is 
equivalent to the currently selected site on 
SPEC 50; either SPEC 50 or 54 can be used 
to alter the ITEM 41 selected site. 


- ITEMs 1 and 2 are alternate sites. They are 
l-loaded to reflect two sites most closely 
associated with the current selected site 
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e ENTRY BEARING 


- Available in OPS 3 and ММ602, 603 (if 
SPEC 54 ASCENT BEARING is selected 
in MM601, it will automatically transition 
to ENTRY BEARING upon transition to 
MM602). 


- ITEM 41 as well as alternate sites for 
ITEMs 1 and 2 carry over from the 
ASCENT BEARING. 


- A bank-oriented shuttle is parked central to 


displayed to the selected and alternate sites 
in the same manner that it is displayed on 
the VERT SIT. 


During OPS 3, the E/W scales are not 
displayed at all. Energy assessment in that 
case is available in MM304 only, using the 
ENTRY TRAJ to depict range to the 
alternate sites via ITEM 4. 


During MM304, roll-reversal lines are also 
shown on either side of the orbiter. 


the display. The next three figures show typical ENTRY 
BEARING displays for ECAL and TAL trajectories. 
The fourth figure shows an example of a low energy 
TAL MM304 ENTRY TRAJ with ITEM 4 enabled 
for alternate sites. 


- An overbright “+” is also displayed off the 
nose of the orbiter representing the ПР, 
similar to the Ascent display. It is based on 
ballistic entry biased with rudimentary 


approximation of entry lift/drag effects for 
ECAL aborts. 


- The selected and alternate sites are plotted 
"polar" to the shuttle's position using the 
guidance-calculated range and current delta 
azimuth. A yellow line connects the shuttle 
to the selected site. Site-centric range rings 
give an approximate indication of range to 
the selected site. 


NOTE 


If the Delta Az is sufficiently large, that site 
would not show in the field of view. 


WARNING 


The guidance-calculated range to a site with 
large Delta Az (> -209 is inaccurate while the 
shuttle is wings-level, which may make it look 
like some sites are farther away than straight 


geographic range would imply. This could 
result in a range difference between that 
displayed on SPEC 54 and that displayed to the 
selected site on the Ascent/Entry Primary 
Flight Display (AEPFD). 


— Delta Az is also shown digitally beneath site 
identifiers for all three sites. 


– During MM602 (post Nz Hold) and 
MM603, the energy-over-weight (E/W) is 
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ECAL Entry to Cherry Point (NKT) with high 
AAz - MM602 pre Nz Hold 
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AAz - MM602 Post Nz Hold 


ENTRY TRAJ on Low Energy TAL with 
Alternate Sites 


E-5 


USA007587 
Rev. A, CPN-1 


This page intentionally left blank 


E-6 


DRD NUMBER: 1.6.1.3-6 


DOCUMENT NUMBER: USA007587 


TITLE: Shuttle Crew Operations Manual (SCOM) 


NASA-JSC 


#АА 
Ар 
ЯАР 
#АР1 
#АРЗ 


«Бу 


“СА 
ЯСА 

СА 

СА 
*#СВ 
*СВ 

ССА2 
*#DA 

DA712 
*#DA72 


DA723 
*DA83 
*#DM 

DM33 

DO 

DO 

DO3 
#DO4 
*DO45 

DOS 

DS 
*#DS 

DS2 

DS4 

DS6 

DS22 

DS23 
*DS23 

DS24 


DS25 


M. Coats (1) 
E. M. Hawley 
D. Leestma (1) 
J. A. Hartsfield (1) 
Branch Chief 
J. A Hartsfield (1) 
JSC-Spice (jsc- 
spice@mail.nasa.gov 
(1) 
B. Jett (1) 
J. Kavandi (1) 
B. Kelly 
K. Abotteen 
All astronauts (90,50) 
B. M. Hajek (1) 
S. Nagel 
P. Hill (1) (1) 
J. Wall 
J. Barckholtz (OPR) 
(3) (1) 
T. Hagin 
MOD Library (2) 
G. Oliver (1) (1) 
TOPO Group Lead 
W. L. Howorth 
P. Beauregard 
J. Heansly 
Branch Chief 
T. Baum 
Branch Chief 
S. A. Curtis (5) 
Group Lead 
L. P. DeLapp (2) 
Branch Chief 
R. A. Galpin 
J. Azbell 
S. Schaeffer (1) (1) 
Branch Chief 
J. P. Jason 
Branch Chief 
P. W. Felker 
Branch Chief 
J. L. Musler 
DPS Group Lead 
J. L. McDonald 
Comm Group Lead 
M. P. Patel 
INCO Library 
DPS Training Group 
Lead 
W. Barnett 
СОММ/М55 Training 
Group Lead 
N. Pierce 


* = HARD COPY 


# = СО 


ALL ELSE ELECTRONIC 


DS42 MMACS Group Lead 
J. J. Dake 
DS43 EGIL Group Lead 
M. E. Friant, Jr. 
DS44 EECOM Group Lead 
D. E. Fasbender 
DS45 Lead Shuttle Systems 
Training 
J. Orcutt 
*DS45 Tech Library 
DS62 GN&C Group Lead 
D. J. Gruber 
DS63 Propulsion Systems 
Group Lead 
J. T. Campa 
DS65 Booster Systems 
Group Lead 
E. J. Turcotte 
DS66 Guidance and 
Control/Prop Training 


Group Lead 
M. Sequeira 
*DS66 Book Manager 
*DX M. Hess (1) 
DX S. Rainwater 
DX2 Branch Chief 
F. S. Markle 
DX3 Branch Chief 
A. R. Prince 
DX4 Branch Chief 
J. H. Cavallaro 
HQ M. Curie 


ZMG/SSP МЕР (1) 

*#MV6 MER Library (1) (1) 

*NC2 SSP Ops (1) 

*#SD2 Training Manager (1) 
(1) 

#SD24 BME Group (3) 


*WR1 Air Force Tech Lib (1) 
NASA-KSC 
#SA-G2 (1) 


REV. A, CPN-1 


USA-HOUSTON 


*H10H-150 V. Atkins (1) 
#USH100A CEO (1) 
#USH-100A COO (1) 
#USH100A Technology 
Chief (1) 
*USH-121G SPOC Tech 
Library (1) 


BNA-HOUSTON 


#HS4-40 Program Chief 
(4) 


Submit NASA distribution changes to JSC Shuttle Acquisition Data Management/BV, including initiator's name and phone 
number, or e-mail jsc-spice@mail.nasa.gov or call 281-244-8506. Submit USA distribution changes to USA Data 
Management/USH-121E, or e-mail USADM@USA-SPACEOPs.COM. Most documents are available electronically via USA 


Intranet Web (https://usa24.usa-spaceops.com/wdk/component/sels) 


USA007587 


Rev. A 
A CCIV Camierás:. nectit tete байда 2.3-2 
Abort Mode Воџпаагіезѕ.................................. 9.1-9 ССТУ System балатпагу хэнөөөөөөөөөөөн 2.3-19 
Active Thermal Control System .................. 29:22, О АО amp and: Heat 
Active Vent System аана 217-2 Exchanger MM и 21-19 
Additional Support Documents .................... 32.2 Closed Circuit Television Subsystem ....... 223-9 
Advanced Crew Escape Suit ....................... 2.10-4 Command and Data Subsystem ................. 2.23-2 
Aft РЫвё|авелллалдлцьлацадциэддадалны 1.2-10 Communications LESE ЫЫ САНЫ Ы 6.8-5 
Аш Sampling System ................ sss 25s. “Communications System Rules of 
Арц Санд Voice Communications Thumb. eed узине нн нне нени ненен нне нне 2.4-53 
disquette abri dite PED Boon: Е te HT SUMAT балаа: 
Alarms. atte ite dtes 22-2 Configuration Control айы нашр ы ырынды ы : 
Altitude, Velocity, and Dynamic Configurations tt MÀ eene 2.23-1 
PEESSUTE ee eee ОБ: “Conbngency-Deorbit Preparation 
Androgynous Peripheral Docking Book жэл 3.3-2 
Убе адин И Worn КОМОРЕ ПИ sane 223 
о д. Ыы лы 2492 шэн Compartment.............. sss то 
Approach and Landing гэл 84? CIYO Leak with Failed Manifold Valve 
APU 1 and Multiple Prox Box Failures ........ 691 сэнөөөөөөөөөөөөөөөөөөөөөөөөөөөөөөөөөө 6.9-3 
АР вагон ова 2141 D 
APU/HYD Caution and Warning Data Bus Network ............. 1... 2.6-7 
пакује unten eee 2.1-23 Data Processing System ................................. 6.8-6 
APU/HYD Rules of Thumb ........................ 21-24 Data Processing System Dictionary ............. 3.4-1 
APU/HYD Summary Data .......................... 21-24 Dedicated Display Systems Summary 
APU/ Hydraulics .................... sss 6.8-2 Рам идиота 2.7-25 
АСР: oh rit e ese 4.3-1, 4.9-1 Definition and Overview ............................... 7.4-1 
Ascent Checklist 2.0200. 31-1  Deorbit Burn .................. eee 5.4-3, 7.3-1 
Ascent Rules of Thumb ...................... 741-12. Deorbit Preprensa: 2.16-35 
Ascent/ Entry Systems Procedures Deorbit Preparation ........................................ 5.4-1 
BOOK алое а и 3.3-1  Deorbit Preparation Book .............................. 3.1-1 
Atmospheric Revitalization System ........... 2.912 Deploy Checklist ......................... sss 32-2 
Attitude Сото] „ананнын 7.22:  Dérotation isinisisi, 7.4-18 
Attitude Director Indicator (ADI) ................. 2.7-3 Description ............ 2.1-1, 2.2-1, 2.3-1, 2.4-1, 2.5-1, 
Audio Central Control Unit ......................... 2.4-29 2.6-1, 2.7-1, 2.8-1, 2.9-1, 2.10-1, 
Audio Communication Subsystem ............. 2.23-3 2.12-1, 2.13-1, 2.14-1 .15-1, 
Audio Distribution System .......................... 2.4-27 2.16-1, 2.17-1, 2.18-1, 2.19-1, 
Autoland ete tee 7.4-25 2.20-1, 2.21-1, 2.22-1, 2.23-1, 
B 2.24-1, 2.25-1, 41-1 
Backup Flight System ........... 71-8, 7.3-12,7 4-23 Device Driver Bi 2.7-2 
ом об 2122 го 215: 
BES Self Engage ааа 6.9-3 о, a a ан 
Body р СРЕ ЕА 1.2:12 ШЄЗОГ МИН ае ы ниш ынын: 087 
ЕИН нне А por ЛЭГ РА аа боз 
Отар ааа ананан 9.2-1 
С Drag Chute. аннин ина ннн ны 214-4 
C/W Rules of Thumb ......ииннөөөөөөөөөн 2.219 Dynamic Flight РҺһазе5з............................. 8.1-1 
C/W Summary Data ..................................... 2.2-19 E 
Cabin Cameras ......... eee 2.3-11 : Я 
Cabin Vent and Side Hatch Jettison ......... 2.10-12 2. and Warning 29-46 
Caution and Warning ................................... 22322, Абас у da oo гы OM нисэж pin 
ECLSS Rules of Thumb ................................ 2.9-58 
маны ааа ь ЭЭЛ асқа Summary Data ia оын атан 2.9-47 


INDEX 


ЏА007587 


Rev. А 
Egress Pole System ..................................... 2.10-13 Flight Crew .............. 8.3-1, 8.4-1, 8.6-1, 8.7-1, 8.8-1 
Electrical Power Distribution......................... 1.4-5 Flight Deck Interfaces ........222..21.. 2.23-2 
Electrical Power Distribution and Flight Instrument Tapes ............................... 2.7-14 
СОЛО ыан ки нын ыы cen menda 2:820. Flight Plann. дининин алаан 3.1-1 
Electrical Power Subsystem ........................ 2.23-2 Forward Fuselage................... sess 1.2-1 
Electrical Power System ............................... 6.8-10 Forward Fuselage and Crew 
Electronic Controller 2.2.22. 2.1-6 Compartment Windows ................... sess 1.2-6 
Emergency Egress Slide ............................. 2.10-13 Fuel Cell Reactant Valves ............................. 6.10-1 
Епоіпеѕ наара МНИ 218-3 Fuel Cell System ................... 2.8-9 
Улааны царигийн 2.16-35, 4.3-1, 4.4-1  FuelSystem 220.....м2мммм0м222111. 2.1-2 
4.9-1,67-3,734 С 
A есе а ГОО ОО о 2424 
pus cu OPE E EO EIE 5. 1.5 Gas Generator and Turbine ........................... 2.1-5 
..........вв. ....!. өөө оо ооо во ооо ооо вовне SET ІР Р MOORE -2 
Entry RCS Use Рафа. ле зог ee RE 5 
Е Rules of Thumb 73.14 Gliding’ RIES „а уније 6.3-6 
D с 2 Pe E -3- GNC Caution and Warning Summary .....2.13-67 
2 нше jg. СМС ЕШ еее 213-75 
ОРОСО УВА о ризо S СМС Summary Data ......... 1111n: 2.13-68 
Environmental Control Subsystem ............ 225-3 бсрс / MDM 6.10-1 
5. 1. сл На энэн: Е Ground Controlled Approach ..................... 7.3-12 
LES OE ТИВ”, гай oe ний tet 8- Guidance, Navigation, and Control .......... 68-12 
EPS Summary Data .............1 2.8-38 H 
Equipment: wo. иында ии ини rettet 2.20-2 
Escape Systems Summary Data ................ 210-22 M Handling Qualities ......2.22.2.....121..... 7.4-20 
ET ПА etri ПИ oet emos 91-8 Hardware and Instrumentation ..................... 1.3-3 
ЕТ Separation ......2ммм044400 нн 6.7-2 Heading Alignment Come ............................. 74-8 
ооо 211-1  Head-Up Display (HUD) нөгөөгөөс 2.7-21 
EVA Rules of Thumb ............. s 211-21 Helium System ................. 2.16-19, 2.18-9, 2.22-9 
EVA Summary Data „ане 241-21  Hold-Down Posts.................... sees 1.4-3 
EVA Support Equipment ........................... 2.11-14 Horizontal Situation Indicator (HSI) ............ 2.7-8 
Exercise Equipment ы 2.5-4 Housekeeping Equipment ............................ 2.5-4 
Exterior Lighting ааган 2.15-14 HYD Press and APU Controller Power 
External Airlock ................................ 2.11-9, 2.19-2 БИЛ: и дамалы ықы 6.10-1 
External Tank Umbilical Doors .................. 2.17-5 Hydraulic Accumulator .............. sss 2.1-19 
Extravehicular Activity Checklists ............... 3.2-1 Hydraulic Heaters ни 2.1-21 
Extravehicular Mobility Unit ..................... 2.112 Hydraulic Power Units ES 1.4-5 
F pU КёвегуоШ нии 2.1-19 
F7 Light Summary ............ 2.2-20 
Fault Detection and Identification ............ 2.182 EE 2. Power Switch 51 EVER 6.10-1 
Fault Message Summary ............................. 2.2-23 In-Flight Maintenance Checklist ................... 3.3-1 
ЕРЕ Fabrication .............м.минөөөөөөөөөөөөөөө 3.5-1  Injector Cooling 5узїеп............................... 2.1-10 
оао 3.5-3 Inner Glideslope ................ e 74-15 
Fire Suppression Subsystem ....................... 2223.3 Insertion OMS BUTS «usted 7.1-7 
Flexible Containers ....................................... 224-4 Instrumentation ............. ааа 2.4-40 
PCD e P EE 3,5-3 | Intercom Protocol ....................44 4.4 8.12 
Flight Control System Hardware ТСН, 213-28 Interior Lighting o 2.15-1 
Flight Control System Pushbutton Intertank пи 1.3-2 
ШЕ О 27-19 | 
JeESySLe T или едете 2.22-3 
INDEX 1-2 


USA007587 


Rev. A 
K Modular Memory Units ............................... 2.6-12 
Ku-Band System шшш 24-3 Monitors eene нии 2.3-14 
L MPS Caution and Warning Summaty ..... 2.16-37 
| MPS Не Leak with APC/ АГС Failure ........ 6.9-1 
Landing атыны ыры КҮЛ EE ATP LEUR 4.3-2 MPS Hydraulic Systems И Ке 2.16-23 
Landing Gear ........... eese 2141 MPS Rules of Thumb v. cesse 2.16-42 
Landing/Deceleration System Rules of MPS Summary Data сл 2.16-39 
Thumb и еее 214-17  MPS Switches ........................................... 6.10-1 
Landing/ Deceleration System Multifunction Electronic Display 
Summary Data .лннөөөөөөөөөөөөөы 214-17 System (MEDS) istaec s 2.6-13 
Last Full On-Orbit Day Бы Ры ал А ОҚЫТ 5.3-8 Multiplexers /Demultiplexers 
Launch and Landing Sites ..................... ld “МЫМЕН амын ы ыды 2.6-11 
Launch Control Center .............. 8.3-1, 8.4-2, 8.8-1 М 
Launch Pad Egress Systems ........................ 2.10-1 талд 
Launch WindoW оа b de Rb Gp. ВО аман. нала а аны 2225 
Lighting System Rules of Thumb ............ 215-16 Nominal Mission Profile EA HÓA 11-2 
Lighting System Summary Data ............... 21516 Nominal Transoceanic Abort Landing ........ 6.4-1 
Liquid Hydrogen Tank .......... 13.3 Nose Gear Touchdown DE 4.7-1 
Liquid Oxygen Тап... 13-2 Nose Wheel Steering ................. 2.14-9 
Location Codes ................ eene 118 О 
Loss of Braking ................ sss 9.3-6 | Off-Nominal Approaches ............................ 7.4-24 
Lubricating Oil... ees 21-5 ОШ Display (SPEC 212) .............................. 2.4-27 
M OMS: (RCS) Вита аи наиб: 5.3-4 
Маш EHglfieg казы санада илла jj. OME ВЕ зд чыныны лала иу 2254 
Маш Gear Touchdown ................ ess ДООМ anon ane у unna ы д НЕ 
Main Hydraulic Pump ............................ 2.1-16 | 5222. ашалы ыды ард 6.10-1 
Маш Landing Gear Brakes .......................... 2.14-5 М ud B: қынаны ыды 851 
Маш Propulsion System .............................. 6.8-12 Бэр | шту АА укшан адан асынан е 
Malfunction Detection ................................ 2.16-25 2 De Тэр UD : th DPS/EP ее. des 
Malfunction Procedures Book ....................... 3.3-1 F x шаа, Эва 
Manipulator Positioning Mechanism ...... 221-11 К e oe pilin ARS AM Ша АА tis teres 22 
Maps and Charts ВооК ини 344 DE inhi Mate Rang none erae 6.6- 
Master Timing Ит................... 26-16 Ми 6.6-1 
Maximum Landing Weight слан. 4641: “Cee atonal Ото АОЛ 
МСС оа т 82-1 System Жаны E на ыш ан 2.5-13 
MDU Configuration ....... 11111111111 о аланы 2 
Mechanical ан 68312 ОрРетаЧогп»............. 21-21, 2.2-12, 2.6-30, 2.8-30, 
Mechanical Systems Rules of Thumb ....... 2.17-21 20 pi pd 
Mechanical Systems Summary Data ........ 2.17-18 14-10, 2.16-282.18-23, 
Е на 9.1-8 е и 
Medical Checklist 22-2 Operations Monitoring and Control ............ 8.2-1 
MEDS ГҮ ОТЫ РАИ irte tete nr RE 2.16-35 
Middeck-Accommodations Кайгылы лыш 224-6 Orbit Operations цийбнн хөнөөөөөөөөөөөнөн 5.3-1 
Миа ивеја бе сав ава pups piedi 194p а АУС па 
о о cetur e 91-9 e aa ез о. 8.1-1 
Mission Control Centers c: 83-1, 84-2, 85-1, Or it ules of T umb xe toe eus ай 7.2-13 
8.6-1, 8.7-1, 8.8-1 Orbital Maneuvering System (OMS) 
Mode 1 - Unaided Egress/ Escape ............ 61-1 DE өөөөөөөөөөөөөөөөөөөөөөөөөөөөө 4.2-2 
Mode 2 - Aided Escape .................................. 6.1-1 rorta! ylaneuyering 
Mode 3 - Aided Escape .................................. 6.1-2 ЭР fey Beacon О та ӨВЧ 
Mode 4 - Aided Escape .................................. Gia Or hual Maneuvering 


System/ Reaction Control System 
(OMS/RCS) Роа анынын 1.2-11 


МРЕХ 


ЏА007587 


Кеу. А 
Orbiter Ground Turnaround.......................... 1.1-6 Procedures for Bailout, Water 
Orbiter Passive Thermal Control................. 1.2-14 Survival, and Rescue ................................ 2.10-18 
Outer Glideslope .................... sess 74-9 Program Documentation................... sse iv 
Overhead Escape Panel .............................. 2.10-18 Propellant Management System 
Overview of Entry Flying Tasks ................... 7.3-1 (PMS) nece tttm da oi 2.16-13 
P Propellant Storage and Distribution ......... 2.18-12 
Рап/ Tilt Units (PTUS) 2... 23-11 Propellant System ............... 2.22.4 
Panel F9 Meters ............. sse 415 К 
Panel ОТ Meters ............... eee 4.1-6 Radiation Equipment .................................... 2.5-14 
Panel O2 Meters ............. sess 41-9 Range Safety „ашин ийиыкинийә нйн 6.2-4 
Panel ОЗ Meters ..........2..22211.. 41-11 Range Safety System... eee 1.4-7 
Parachute Harness and Parachute ............. 2.10-6 Rapid Cabin Depressurization .................... 2.2-11 
Рау!дайнсслаханциинаанцилнллааа цайлган 9171 RCS Caution and Warning Summary ...... 2.22-18 
Payload Bay Door System ........................... 2.17-9 RCS Redundancy Management ................ 2.22-12 
Payload Communication System ............... 2.4-22 КС5 Rules of Thumb ....22..2222221.... 2.22-25 
Payload Deployment and Retrieval RCS Summary Data ..........: 7 2.22-25 
System Operations Checklist ..................... 3.221 Reach and Visibility Aids ............................... 2.5-5 
Payload Operations Checklist ....................... 3.2-2 Reaction Control System (RCS) Jets .............. 4.2-3 
Payload Retention Mechanisms ............... 2.21-15 Reaction Control System Command 
Payload Systems Data and Lights А 2.7-19 
Malfunction Procedures Book .................... 3.3-1 Reference Data Book ....................................... 3.4-1 
Payload Systems Data/ Malfunction Remote Manipulator System ....................... 2.21-1 
о эгнэгт дадлага 34-1 “Кейде?уоив ионные 5.3-4 
PDRS Caution and Warning Summary Rendezvous Checklist ........2.2.2.2.2.22. 1... 3.2-1 
И ОУ 2.2123 Rendezvous/Proximity Operations .............7.2-6 
PDRS Rules of Thumb ................................ 2.21-28 Restraints and Mobility Aids ......................... 2.5-5 
PDRS Summary Data ................................. 2.21-24 Rigid Containers .................... sese 2.24-1 
Performance Aborts ................ sse 6.271 .Rollout ose ed retener 7.4-19 
Performance Rules of Thumb ...................... 9,3-12. Rollout History... eee tette 9.3-6 
Репоа ——M——M— 92-1  Rollout/ Braking... sse 9.3-6 
Personal Hygiene Provisions ........................ 2.5-1 RTLS Abort Propellant Dump 
Pertürbatiofis ыныран ee dete 9.2-1 SeQUEence ка peperit ede 2.16-35 
PFD Status Indicators ................................... 2.7-16 Rules of Thumb ............ e 7.4-28 
Photo/TV Checklist ......................... sss 321 6 
Photographic Equipment ............................. 25-8  cBand Frequency Modulation .................... 24-10 
PED Merk Tower Enable sinnti 6.10-1 5 Band Phase Modulation .......... 2.4-2 
Pocket Checklists EE 3.3-1 Second Hydraulic Failure and 1 SSME 
КО ПРЕ ON оле о о T, 6.9-1 
Post Insertion Book ....... хөөөөөөөөөөөөөөөн 34-1 Sens оту CUS шшш... 71-10, 73-12, 7.4-25 
цэл МЕСІ кие Avert Set Splits During Ascent ................................. 6.9-1 
Гапат орион 6.4-3 Shuttle Orbiter Medical System мин 25-10 
Power Reactants Storage and Sighting Aid 25-9 
eae ghtinp AidS ensis О : 
Distribution бух е а аи ии 2.8-1 Simplified Aid for EVA Rescue ................. 211-16 
Powered BUGRE е ие. Sleeping Provisions .................... ees 2.5-1 
Powered КЕ а ниси но њиви и исти» 6:3-2 Smoke Detection and Fire 
Preflare аза и ete ани 7.4-14 Su : 22-5 
На Ч И И : 
Prelaunch Procedutes цах сн ыны DUAE T E a 2.6-20 
Preliminariés:. socero e ала дыр 3.5-1 Space Shuttle Coordinate Reference 
Бо C onfrol ум цн 84 SYSTE а а нао 11-7 
Primary Flight Display ................................ 2.7-3 


INDEX 


USA007587 


Rev. A 
Space Shuttle Main Engine УМ 
Controllers ....... MM хэнөөөөөөөөөиөөн 2168 Water Spray Boilers ш... 21-12 
Space ВА Mam Pigines Wind Effects on Trajectory .......................... 7.4-22 
(SSMEs) зиөөөөөөөөөиииөөөөөөөөн 2.16-3, 4.241. Window Shades and Filters ое ен 25-10 
ре ыыы радиа. Ts Wing aesti duet ed 1.2-7 
SPEC 60, SM Table Maintenance ................ 2.2-15 | 
Squatcheloids;......-2 eiie 9.1-3 
SRB Descent and Кесоуегу............................. 1.4-8 
SRB Ignition „г.нар 14-4 
SRB Rate Gyro Assemblies ............................. 1.4-6 
SRB Separation ................... иене 1.4-7 
Stowage Containers ......гхннөөөөөөөөөөөөөөөөө 2.5-5 
Stuck Throttle in the Bucket ........................... 6.9-1 
Supply and Wastewater Systems ................ 2.9-34 
Surface Position Indicator (SPI) .................. 2.7-17 
Systems Abort Once Around Book ............... 3.3-1 
Systems Aborts диа иене 6.2-3 
Systems Data Book ......222...4.4.22221.... 3.4-1 
T 
TAL Abort Propellant Dump 
овамепев аи аурора ата 2.16-36 
Telemetry Uplink .................... sees 8.2-3 
Terminal Area Energy Management ............ 7.4-1 
Terminal Area Energy Management 
(EAEM ) ettet rts 5.4-6 
Terminal Area Energy Management 
and Approach, Landing, and Rollout ...... 7.4-28 
Thermal Control ............................. 2.18-19, 2.22-11 
Thermal Protection System................. 1.2-15, 1.3-3 
Three-Engine-Out Automation ..................... 6.7-2 
Thrust Vector Control...................... sss 1.4-6 
Thrust Vector Control (ТУС) ..................... 2.18-20 
Total Loss of FES ................ sss 6.9-2 
Total Loss of FES with BFS Failure ............... 6.9-2 
TouchdOoWn-... eite tetro se 7.4-16 
Trajectoty.i:. steep nte tee eee 9.3-2 
Translation „наин tte 7.2-5 
Truss Assembly ................. sss 2.192 
TV Cue Card 2: mene nee neoini 2.3-16 
Two APUs/ Hydraulic Systems .................... 6.9-1 
Two Freon/ Water Loops ............................... 6.9-2 
Two Fuel Cells „ии tette 6.9-2 
U 
Ultrahigh Frequency Simplex System ........ 2.4-24 
V 
Vehicle Loss of Control/Breakup ............. 2.10-21 
Vertical Tail алан eerte 1.2-13 
Video Processing Equipment ........................ 2.3-6 
Уи Diagrams ла хулганаа 4.9-1 
Volume A - Pantry .......7 77e 2.12-3 
VIRS ани 2.3-13 
1-5 INDEX 


UA007587 
Rev. A 


This page intentionally left blank 


INDEX 1-6 


